From 63937f592e11edbd2299525e24633821fb7131f8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20Marjam=C3=A4ki?= <danielm77@spray.se>
Date: Sun, 30 Oct 2011 17:59:38 +0100
Subject: [PATCH] Fixed #3228 (false positive: possible null pointer
 dereference)

---
 lib/checknullpointer.cpp |  9 ++++++++-
 test/testnullpointer.cpp | 19 ++++++++++++-------
 2 files changed, 20 insertions(+), 8 deletions(-)

diff --git a/lib/checknullpointer.cpp b/lib/checknullpointer.cpp
index 15a0ee812..5cdbc796b 100644
--- a/lib/checknullpointer.cpp
+++ b/lib/checknullpointer.cpp
@@ -436,6 +436,8 @@ void CheckNullPointer::nullPointerStructByDeRefAndChec()
             continue;
         }
 
+        bool inconclusive = false;
+
         /**
          * @todo There are lots of false negatives here. A dereference
          *  is only investigated if a few specific conditions are met.
@@ -444,6 +446,11 @@ void CheckNullPointer::nullPointerStructByDeRefAndChec()
         // dereference in assignment
         if (Token::Match(tok1, "[;{}] %var% . %var%")) {
             tok1 = tok1->next();
+            if (tok1->strAt(3) == "(") {
+                if (!_settings->inconclusive)
+                    continue;
+                inconclusive = true;
+            }
         }
 
         // dereference in assignment
@@ -559,7 +566,7 @@ void CheckNullPointer::nullPointerStructByDeRefAndChec()
             else if (Token::Match(tok2, "if ( !| %varid% )|&&", varid1)) {
                 // Is this variable a pointer?
                 if (isPointer(varid1))
-                    nullPointerError(tok1, varname, tok2->linenr());
+                    nullPointerError(tok1, varname, tok2->linenr(), inconclusive);
                 break;
             }
         }
diff --git a/test/testnullpointer.cpp b/test/testnullpointer.cpp
index abd2b8573..7d0182a04 100644
--- a/test/testnullpointer.cpp
+++ b/test/testnullpointer.cpp
@@ -256,13 +256,6 @@ private:
               "}\n");
         ASSERT_EQUALS("[test.cpp:2]: (error) Possible null pointer dereference: abc - otherwise it is redundant to check if abc is null at line 3\n", errout.str());
 
-        check("void foo(ABC *abc) {\n"
-              "    abc->do_something();\n"
-              "    if (abc)\n"
-              "        ;\n"
-              "}\n");
-        ASSERT_EQUALS("[test.cpp:2]: (error) Possible null pointer dereference: abc - otherwise it is redundant to check if abc is null at line 3\n", errout.str());
-
         check("void foo(ABC *abc) {\n"
               "    if (abc->a == 3) {\n"
               "        return;\n"
@@ -432,6 +425,18 @@ private:
               "    if (abc) {}\n"
               "}");
         ASSERT_EQUALS("", errout.str());
+
+        // #3228 - calling function with null object
+        {
+            const char code[] = "void f(Fred *fred) {\n"
+                                "    fred->x();\n"
+                                "    if (fred) { }\n"
+                                "}";
+            check(code);
+            ASSERT_EQUALS("", errout.str());
+            check(code, true);
+            ASSERT_EQUALS("[test.cpp:2]: (error) Possible null pointer dereference: fred - otherwise it is redundant to check if fred is null at line 3\n", errout.str());
+        }
     }
 
     // Dereferencing a pointer and then checking if it is null