Fixed #6873 (False positive uninitvar - variable initialized via pointer)

lib/checkuninitvar.cpp

@@ -487,8 +487,12 @@ bool CheckUninitVar::checkScopeForVariable(const Token *tok, const Variable& var
             const Token *end = tok->next()->link();
 
             // If address of variable is taken in the block then bail out
-            if (Token::findmatch(tok->tokAt(2), "& %varid%", end, var.declarationId()))
+            if (var.isPointer() || var.isArray()) {
+                if (Token::findmatch(tok->tokAt(2), "%varid%", end, var.declarationId()))
+                    return true;
+            } else if (Token::findmatch(tok->tokAt(2), "& %varid%", end, var.declarationId())) {
                 return true;
+            }
 
             // Skip block
             tok = end;

test/testuninitvar.cpp

@@ -45,6 +45,7 @@ private:
         TEST_CASE(uninitvar_switch);    // handling switch
         TEST_CASE(uninitvar_references); // references
         TEST_CASE(uninitvar_return);    // return
+        TEST_CASE(uninitvar_assign);    // = {..}
         TEST_CASE(uninitvar_strncpy);   // strncpy doesn't always null-terminate
         TEST_CASE(func_uninit_var);     // analyse function calls for: 'int a(int x) { return x+x; }'
         TEST_CASE(func_uninit_pointer); // analyse function calls for: 'void a(int *p) { *p = 0; }'
@@ -486,16 +487,6 @@ private:
                        "}");
         ASSERT_EQUALS("[test.cpp:4]: (error) Uninitialized variable: s\n", errout.str());
 
-        // #1533
-        checkUninitVar("char a()\n"
-                       "{\n"
-                       "    char key;\n"
-                       "    struct A msg = { .buf = {&key} };\n"
-                       "    init(&msg);\n"
-                       "    key++;\n"
-                       "}");
-        ASSERT_EQUALS("", errout.str());
-
         checkUninitVar("void foo()\n"
                        "{\n"
                        "   char *buf = malloc(100);\n"
@@ -1892,6 +1883,18 @@ private:
                            "}");
             ASSERT_EQUALS("[test.cpp:3]: (error) Uninitialized variable: i\n", errout.str());
         }
+    }
+
+    void uninitvar_assign() {  // = { .. }
+        // #1533
+        checkUninitVar("char a()\n"
+                       "{\n"
+                       "    char key;\n"
+                       "    struct A msg = { .buf = {&key} };\n"
+                       "    init(&msg);\n"
+                       "    key++;\n"
+                       "}");
+        ASSERT_EQUALS("", errout.str());
 
         // Ticket #5660 - False positive
         checkUninitVar("int f() {\n"
@@ -1901,6 +1904,25 @@ private:
                        "    return result;\n"
                        "}");
         ASSERT_EQUALS("", errout.str());
+
+        // #6873
+        checkUninitVar("int f() {\n"
+                       "    char a[10];\n"
+                       "    char *b[] = {a};\n"
+                       "    foo(b);\n"
+                       "    return atoi(a);\n"
+                       "}");
+        ASSERT_EQUALS("", errout.str());
+
+        // = { .. }
+        checkUninitVar("int f() {\n"
+                       "    int a;\n"
+                       "    int *p[] = { &a };\n"
+                       "    *p[0] = 0;\n"
+                       "    return a;\n"
+                       "}");
+        ASSERT_EQUALS("", errout.str());
+
     }
 
     // strncpy doesn't always null-terminate..
@@ -2139,15 +2161,6 @@ private:
                        "}");
         ASSERT_EQUALS("", errout.str());
 
-        // = { .. }
-        checkUninitVar("int f() {\n"
-                       "    int a;\n"
-                       "    int *p[] = { &a };\n"
-                       "    *p[0] = 0;\n"
-                       "    return a;\n"
-                       "}");
-        ASSERT_EQUALS("", errout.str());
-
         // = ({ .. })
         checkUninitVar("void f() {\n"
                        "    int x = ({ 1 + 2; });\n"