From 58c3fdd0633fd3639f1639f40ffc2feb73d8c0e6 Mon Sep 17 00:00:00 2001
From: PKEuS <philipp.kloke@web.de>
Date: Sun, 1 Feb 2015 12:26:46 +0100
Subject: [PATCH] Fixed crash on garbage code introduced recently, optimized
 code in valueFlowFunctionReturn.

---
 lib/valueflow.cpp    | 22 +++++++++++++---------
 test/testgarbage.cpp |  3 +++
 2 files changed, 16 insertions(+), 9 deletions(-)

diff --git a/lib/valueflow.cpp b/lib/valueflow.cpp
index 46e4bf577..844e5b3a3 100644
--- a/lib/valueflow.cpp
+++ b/lib/valueflow.cpp
@@ -1531,6 +1531,10 @@ static void valueFlowForLoop(TokenList *tokenlist, SymbolDatabase* symboldatabas
         Token* tok = const_cast<Token*>(scope->classDef);
         Token* const bodyStart = const_cast<Token*>(scope->classStart);
 
+        if (!Token::simpleMatch(tok->next()->astOperand2(), ";") ||
+            !Token::simpleMatch(tok->next()->astOperand2()->astOperand2(), ";"))
+            continue;
+
         unsigned int varid(0);
         MathLib::bigint num1(0), num2(0), numAfter(0);
 
@@ -1632,6 +1636,15 @@ static void valueFlowFunctionReturn(TokenList *tokenlist, ErrorLogger *errorLogg
         if (tok->str() != "(" || !tok->astOperand1() || !tok->astOperand1()->function())
             continue;
 
+        // Get scope and args of function
+        const Function * const function = tok->astOperand1()->function();
+        const Scope * const functionScope = function->functionScope;
+        if (!functionScope || !Token::simpleMatch(functionScope->classStart, "{ return")) {
+            if (functionScope && settings->debugwarnings)
+                bailout(tokenlist, errorLogger, tok, "function return; nontrivial function body");
+            continue;
+        }
+
         // Arguments..
         std::vector<MathLib::bigint> parvalues;
         {
@@ -1650,15 +1663,6 @@ static void valueFlowFunctionReturn(TokenList *tokenlist, ErrorLogger *errorLogg
                 continue;
         }
 
-        // Get scope and args of function
-        const Function * const function = tok->astOperand1()->function();
-        const Scope * const functionScope = function ? function->functionScope : nullptr;
-        if (!functionScope || !Token::simpleMatch(functionScope->classStart, "{ return")) {
-            if (functionScope && settings->debugwarnings)
-                bailout(tokenlist, errorLogger, tok, "function return; nontrivial function body");
-            continue;
-        }
-
         std::map<unsigned int, MathLib::bigint> programMemory;
         for (std::size_t i = 0; i < parvalues.size(); ++i) {
             const Variable * const arg = function->getArgumentVar(i);
diff --git a/test/testgarbage.cpp b/test/testgarbage.cpp
index 91f2d15ba..58b74d74f 100644
--- a/test/testgarbage.cpp
+++ b/test/testgarbage.cpp
@@ -400,6 +400,9 @@ private:
         // 6122 survive garbage code
         code = "; { int i ; for ( i = 0 ; = 123 ; ) - ; }";
         checkCode(code);
+
+        code = "void f1() { for (int n = 0 n < 10 n++); }";
+        checkCode(code);
     }
 
     void garbageSymbolDatabase() {