Fixed #1670 (False negative: Array index out of bounds in return statement)

lib/checkbufferoverrun.cpp

@@ -593,6 +593,14 @@ void CheckBufferOverrun::checkScope(const Token *tok, const std::vector<std::str
                     }
                 }
             }
+            if (Token::Match(tok, "return %varid% [ %num% ]", varid))
+            {
+                int index = MathLib::toLongNumber(tok->strAt(3));
+                if (index < 0 || index >= size)
+                {
+                    arrayIndexOutOfBounds(tok->next(), size, index);
+                }
+            }
         }
         else if (!tok->isName() && !Token::Match(tok, "[.&]") && Token::Match(tok->next(), (varnames + " [ %num% ]").c_str()))
         {

test/testbufferoverrun.cpp

@@ -1961,6 +1961,14 @@ private:
               "}\n");
         ASSERT_EQUALS("[test.cpp:4]: (error) Array 's[10]' index 10 out of bounds\n", errout.str());
 
+        // ticket #1670 - false negative when using return
+        check("void f()\n"
+              "{\n"
+              "    char *s = new int[10];\n"
+              "    return s[10];\n"
+              "}\n");
+        ASSERT_EQUALS("[test.cpp:4]: (error) Array 's[10]' index 10 out of bounds\n", errout.str());
+
         check("void foo()\n"
               "{\n"
               "char * buf = new char[8];\n"