From 663a8411ddd2d4e6b556af94b7ee43fdc78eed1e Mon Sep 17 00:00:00 2001
From: Paul Fultz II <pfultz2@yahoo.com>
Date: Thu, 8 Dec 2022 00:27:06 -0600
Subject: [PATCH] Fix 11416: FP nullPointerRedundantCheck for check after loop
 with break (#4620)

---
 lib/reverseanalyzer.cpp  |  2 ++
 test/testnullpointer.cpp | 20 ++++++++++++++++++++
 2 files changed, 22 insertions(+)

diff --git a/lib/reverseanalyzer.cpp b/lib/reverseanalyzer.cpp
index ea71608e3..c6c86c758 100644
--- a/lib/reverseanalyzer.cpp
+++ b/lib/reverseanalyzer.cpp
@@ -281,6 +281,8 @@ struct ReverseTraversal {
                 const bool inLoop = condTok->astTop() && Token::Match(condTok->astTop()->previous(), "for|while (");
                 // Evaluate condition of for and while loops first
                 if (inLoop) {
+                    if (Token::findmatch(tok->link(), "goto|break", tok))
+                        break;
                     if (condAction.isModified())
                         break;
                     valueFlowGenericForward(condTok, analyzer, settings);
diff --git a/test/testnullpointer.cpp b/test/testnullpointer.cpp
index 81c7f1e64..3e53ca8ce 100644
--- a/test/testnullpointer.cpp
+++ b/test/testnullpointer.cpp
@@ -139,6 +139,7 @@ private:
         TEST_CASE(nullpointer93); // #3929
         TEST_CASE(nullpointer94); // #11040
         TEST_CASE(nullpointer95); // #11142
+        TEST_CASE(nullpointer96); // #11416
         TEST_CASE(nullpointer_addressOf); // address of
         TEST_CASE(nullpointerSwitch); // #2626
         TEST_CASE(nullpointer_cast); // #4692
@@ -2763,6 +2764,25 @@ private:
         ASSERT_EQUALS("", errout.str());
     }
 
+    void nullpointer96()
+    {
+        check("struct S {\n"
+              "  int x;\n"
+              "};\n"
+              "S *create_s();\n"
+              "void test() {\n"
+              "  S *s = create_s();\n"
+              "  for (int i = 0; i < s->x; i++) {\n"
+              "    if (s->x == 17) {\n"
+              "      s = nullptr;\n"
+              "      break;\n"
+              "    }\n"
+              "  }\n"
+              "  if (s) {}\n"
+              "}\n");
+        ASSERT_EQUALS("", errout.str());
+    }
+
     void nullpointer_addressOf() { // address of
         check("void f() {\n"
               "  struct X *x = 0;\n"