diff --git a/lib/checkbufferoverrun.cpp b/lib/checkbufferoverrun.cpp index f9a15260b..958e0b575 100644 --- a/lib/checkbufferoverrun.cpp +++ b/lib/checkbufferoverrun.cpp @@ -2168,7 +2168,7 @@ void CheckBufferOverrun::executionPaths() for (size_t i = 1; i <= _tokenizer->varIdCount(); i++) { const Variable *var = _tokenizer->getSymbolDatabase()->getVariableFromVarId(i); - if (var && var->isArray()) + if (var && var->isArray() && var->dimension(0) > 0) arrayInfo[i] = ArrayInfo(var, _tokenizer); } diff --git a/test/testbufferoverrun.cpp b/test/testbufferoverrun.cpp index 236040fd8..83f53e992 100644 --- a/test/testbufferoverrun.cpp +++ b/test/testbufferoverrun.cpp @@ -208,6 +208,7 @@ private: TEST_CASE(executionPaths2); TEST_CASE(executionPaths3); // no FP for function parameter TEST_CASE(executionPaths4); // Ticket #2386 - Segmentation fault in the ExecutionPath handling + TEST_CASE(executionPaths5); // Ticket #2920 - False positive when size is unknown TEST_CASE(cmdLineArgs1); @@ -2859,6 +2860,20 @@ private: ASSERT_EQUALS("", errout.str()); } + void executionPaths5() + { + // No false positive + epcheck("class A {\n" + " void foo() {\n" + " int j = g();\n" + " arr[j]=0;\n" + " }\n" + "\n" + " int arr[2*BSize + 2];\n" + "};\n"); + ASSERT_EQUALS("", errout.str()); + } + void cmdLineArgs1() { check("int main(int argc, char* argv[])\n"