From 5c3315db7a078878a0273fe3bf56f35fa130ef6f Mon Sep 17 00:00:00 2001
From: Robert Reif <reif@earthlink.net>
Date: Wed, 28 Aug 2013 05:57:40 +0200
Subject: [PATCH] CheckIO: improved handling of functions returning pointers.
 Ticket: #4964

---
 lib/checkio.cpp | 17 ++++++++++++++---
 test/testio.cpp |  7 +++++++
 2 files changed, 21 insertions(+), 3 deletions(-)

diff --git a/lib/checkio.cpp b/lib/checkio.cpp
index daec23332..581c3eb85 100644
--- a/lib/checkio.cpp
+++ b/lib/checkio.cpp
@@ -661,7 +661,8 @@ void CheckIO::checkWrongPrintfScanfArguments()
                                     case 'G':
                                         specifier += *i;
                                         if (functionInfo && varTypeTok && (((varTypeTok->isStandardType() || functionInfo->retType) && !Token::Match(varTypeTok, "float|double")) ||
-                                                                           Token::simpleMatch(varTypeTok->next(), "*") ||
+                                                                           (!element && Token::simpleMatch(varTypeTok->next(), "*")) ||
+                                                                           (element && !Token::simpleMatch(varTypeTok->next(), "*")) ||
                                                                            (specifier[0] == 'l' && (!varTypeTok->isLong() || varTypeTok->str() != "double")) ||
                                                                            (specifier[0] != 'l' && varTypeTok->isLong())))
                                             invalidPrintfArgTypeError_float(tok, numFormat, specifier);
@@ -781,9 +782,19 @@ bool CheckIO::getArgumentInfo(const Token * tok, const Variable **var, const Tok
             const Token *tok1 = tok->next();
             for (; tok1; tok1 = tok1->next()) {
                 if (tok1->str() == "," || tok1->str() == ")") {
-                    if (tok1->previous()->str() == "]")
+                    if (tok1->previous()->str() == "]") {
                         varTok = tok1->linkAt(-1)->previous();
-                    else if (tok1->previous()->str() == ")" && tok1->linkAt(-1)->previous()->type() == Token::eFunction) {
+                        if (varTok->str() == ")" && varTok->link()->previous()->type() == Token::eFunction) {
+                            const Function * function = varTok->link()->previous()->function();
+                            if (function) {
+                                *var = 0;
+                                *typeTok = function->retDef;
+                                *func = function;
+                                element = true;
+                                return true;
+                            }
+                        }
+                    } else if (tok1->previous()->str() == ")" && tok1->linkAt(-1)->previous()->type() == Token::eFunction) {
                         const Function * function = tok1->linkAt(-1)->previous()->function();
                         if (function) {
                             *var = 0;
diff --git a/test/testio.cpp b/test/testio.cpp
index e953a0916..baeb87202 100644
--- a/test/testio.cpp
+++ b/test/testio.cpp
@@ -1021,6 +1021,13 @@ private:
               "}\n");
         ASSERT_EQUALS("", errout.str());
 
+        check("int array[10];\n"
+              "int * foo() { return array; }\n"
+              "void f() {\n"
+              "    printf(\"%f\", foo()[0]);\n"
+              "}\n");
+        ASSERT_EQUALS("[test.cpp:4]: (warning) %f in format string (no. 1) requires a floating point number given in the argument list.\n", errout.str());
+
     }
 
     void testPosixPrintfScanfParameterPosition() { // #4900  - No support for parameters in format strings