From 41a06a21d9d49bd029ac8e24e96a83574fc29f9c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20Marjam=C3=A4ki?= <danielm77@spray.se>
Date: Mon, 25 Oct 2010 17:36:46 +0200
Subject: [PATCH] using deallocated pointer: detect first problem reported in
 ticket #2090

---
 lib/checkmemoryleak.cpp | 20 +++++++++++++++++++-
 test/testmemleak.cpp    |  7 +++++++
 2 files changed, 26 insertions(+), 1 deletion(-)

diff --git a/lib/checkmemoryleak.cpp b/lib/checkmemoryleak.cpp
index aba91179d..c5e7bd436 100644
--- a/lib/checkmemoryleak.cpp
+++ b/lib/checkmemoryleak.cpp
@@ -661,7 +661,23 @@ bool CheckMemoryLeakInFunction::test_white_list(const std::string &funcname)
 const char * CheckMemoryLeakInFunction::call_func(const Token *tok, std::list<const Token *> callstack, const unsigned int varid, AllocType &alloctype, AllocType &dealloctype, bool &allocpar, unsigned int sz)
 {
     if (test_white_list(tok->str()))
-        return 0;
+    {
+        if (tok->str() == "asprintf" ||
+            tok->str() == "delete" ||
+            tok->str() == "fclose" ||
+            tok->str() == "for" ||
+            tok->str() == "free" ||
+            tok->str() == "if" ||
+            tok->str() == "realloc" ||
+            tok->str() == "return" ||
+            tok->str() == "switch" ||
+            tok->str() == "while")
+        {
+            return 0;
+        }
+
+        return "use_";
+    }
 
     if (noreturn.find(tok->str()) != noreturn.end())
         return "exit";
@@ -1366,6 +1382,8 @@ Token *CheckMemoryLeakInFunction::getcode(const Token *tok, std::list<const Toke
             }
             else if (Token::Match(tok->previous(), "[;{}=(,+-*/] %varid% [", varid))
             {
+                // warning is written for "dealloc ; use_ ;".
+                // but this use doesn't affect the leak-checking
                 addtoken(&rettail, tok, "use_");
             }
         }
diff --git a/test/testmemleak.cpp b/test/testmemleak.cpp
index 295a33b42..0834dff15 100644
--- a/test/testmemleak.cpp
+++ b/test/testmemleak.cpp
@@ -2273,6 +2273,13 @@ private:
               "    str[10] = 0;\n"
               "}\n");
         ASSERT_EQUALS("[test.cpp:5]: (error) Dereferencing 'str' after it is deallocated / released\n", errout.str());
+
+        check("void foo() {\n"
+              "    char *str = malloc(10);\n"
+              "    free(str);\n"
+              "    strcpy(str, p);\n"
+              "}\n");
+        ASSERT_EQUALS("[test.cpp:4]: (error) Dereferencing 'str' after it is deallocated / released\n", errout.str());
     }