From 5490fad8c76348c6862a9e0bef2c843adc123869 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20Marjam=C3=A4ki?= <daniel.marjamaki@gmail.com>
Date: Sun, 14 Dec 2014 14:10:42 +0100
Subject: [PATCH] Fixed #5840 (False positive (inconclusive): Possible
 nullpointer dereference - use before for-loop over nested list)

---
 lib/valueflow.cpp      | 10 ++++++++++
 test/testvalueflow.cpp |  6 ++++++
 2 files changed, 16 insertions(+)

diff --git a/lib/valueflow.cpp b/lib/valueflow.cpp
index 84bf8a53d..3819449f3 100644
--- a/lib/valueflow.cpp
+++ b/lib/valueflow.cpp
@@ -468,6 +468,16 @@ static void valueFlowBeforeCondition(TokenList *tokenlist, ErrorLogger *errorLog
             if (tok2->astParent() || tok2->str() != "(" || !Token::simpleMatch(tok2->link(), ") {"))
                 continue;
 
+            // Variable changed in 3rd for-expression
+            if (Token::simpleMatch(tok2->previous(), "for (")) {
+                if (isVariableChanged(tok2->astOperand2()->astOperand2(), tok2->link(), varid)) {
+                    varid = 0U;
+                    if (settings->debugwarnings)
+                        bailout(tokenlist, errorLogger, tok, "variable " + var->name() + " used in loop");
+                }
+            }
+
+            // Variable changed in loop code
             if (Token::Match(tok2->previous(), "for|while (")) {
                 const Token * const start = tok2->link()->next();
                 const Token * const end   = start->link();
diff --git a/test/testvalueflow.cpp b/test/testvalueflow.cpp
index d105bf7fe..2300daa17 100644
--- a/test/testvalueflow.cpp
+++ b/test/testvalueflow.cpp
@@ -403,6 +403,12 @@ private:
                "}";
         ASSERT_EQUALS(false, testValueOfX(code, 2U, 37));
 
+        code = "void f(int x) {\n"
+               "  a = x;\n"
+               "  for (; x!=1; x++) { }\n"
+               "}";
+        ASSERT_EQUALS(false, testValueOfX(code, 2U, 1));
+
         code = "void f(menu *x) {\n"
                "  a = x->parent;\n"
                "  for (i=0;(i<10) && (x!=0); i++) { x = x->next; }\n"