Fixed uninitialized variable FP after realloc if it fails. Related with ticket: #5240
This commit is contained in:
parent
825174d394
commit
3e6fbc6517
|
@ -614,6 +614,8 @@ private:
|
||||||
if (Token::Match(&tok, "free|kfree|fclose ( %var% )") ||
|
if (Token::Match(&tok, "free|kfree|fclose ( %var% )") ||
|
||||||
Token::Match(&tok, "realloc ( %var%")) {
|
Token::Match(&tok, "realloc ( %var%")) {
|
||||||
dealloc_pointer(checks, tok.tokAt(2));
|
dealloc_pointer(checks, tok.tokAt(2));
|
||||||
|
if (tok.str() == "realloc")
|
||||||
|
ExecutionPath::bailOutVar(checks, tok.tokAt(2)->varId());
|
||||||
return tok.tokAt(3);
|
return tok.tokAt(3);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
@ -106,6 +106,13 @@ private:
|
||||||
"}");
|
"}");
|
||||||
ASSERT_EQUALS("[test.cpp:3]: (error) Uninitialized variable: p\n", errout.str());
|
ASSERT_EQUALS("[test.cpp:3]: (error) Uninitialized variable: p\n", errout.str());
|
||||||
|
|
||||||
|
checkUninitVar("void foo() {\n" // #5240
|
||||||
|
" char *p = malloc(100);\n"
|
||||||
|
" char *tmp = realloc(p,1000);\n"
|
||||||
|
" if (!tmp) free(p);\n"
|
||||||
|
"}");
|
||||||
|
ASSERT_EQUALS("", errout.str());
|
||||||
|
|
||||||
checkUninitVar("void foo() {\n"
|
checkUninitVar("void foo() {\n"
|
||||||
" int *p = NULL;\n"
|
" int *p = NULL;\n"
|
||||||
" realloc(p,10);\n"
|
" realloc(p,10);\n"
|
||||||
|
|
Loading…
Reference in New Issue