Fixed #2920 (False positive: Array 'arr[0]' index 0 out of bounds (array size and index are unknown))

lib/checkbufferoverrun.cpp

@@ -2168,7 +2168,7 @@ void CheckBufferOverrun::executionPaths()
     for (size_t i = 1; i <= _tokenizer->varIdCount(); i++)
     {
         const Variable *var = _tokenizer->getSymbolDatabase()->getVariableFromVarId(i);
-        if (var && var->isArray())
+        if (var && var->isArray() && var->dimension(0) > 0)
             arrayInfo[i] = ArrayInfo(var, _tokenizer);
     }
 

test/testbufferoverrun.cpp

@@ -208,6 +208,7 @@ private:
         TEST_CASE(executionPaths2);
         TEST_CASE(executionPaths3);   // no FP for function parameter
         TEST_CASE(executionPaths4);   // Ticket #2386 - Segmentation fault in the ExecutionPath handling
+        TEST_CASE(executionPaths5);   // Ticket #2920 - False positive when size is unknown
 
         TEST_CASE(cmdLineArgs1);
 
@@ -2859,6 +2860,20 @@ private:
         ASSERT_EQUALS("", errout.str());
     }
 
+    void executionPaths5()
+    {
+        // No false positive
+        epcheck("class A {\n"
+                "    void foo() {\n"
+                "        int j = g();\n"
+                "        arr[j]=0;\n"
+                "    }\n"
+                "\n"
+                "    int arr[2*BSize + 2];\n"
+                "};\n");
+        ASSERT_EQUALS("", errout.str());
+    }
+
     void cmdLineArgs1()
     {
         check("int main(int argc, char* argv[])\n"