Fixed #4228 ((error) Internal error. Token::Match called with varid 0 (multiple declarations in for loop))

lib/checkbufferoverrun.cpp

@@ -248,7 +248,8 @@ static bool bailoutIfSwitch(const Token *tok, const unsigned int varid)
  * \param varid [out] varid of counter variable
  * \param varname [out] name of counter variable
  * \param init_value [out] init value of counter variable
- * \return success => pointer to the for loop condition. fail => 0
+ * \return success => pointer to the for loop condition. fail => 0. If 0 is returned and varname has been set then there is
+ * a missing varid for the counter variable
  */
 static const Token *for_init(const Token *tok, unsigned int &varid, std::string &varname, std::string &init_value)
 {
@@ -260,6 +261,9 @@ static const Token *for_init(const Token *tok, unsigned int &varid, std::string
         varid = tok->varId();
         varname = tok->str();
         tok = tok->tokAt(4);
+
+        if (varid == 0)
+            return 0;  // failed
     } else if (Token::Match(tok, "%type% %var% = %any% ;")) {
         if (tok->tokAt(3)->isNumber()) {
             init_value = tok->strAt(3);
@@ -719,6 +723,8 @@ void CheckBufferOverrun::checkScopeForBody(const Token *tok, const ArrayInfo &ar
     std::string counter_init_value;
 
     tok2 = for_init(tok2, counter_varid, counter_name, counter_init_value);
+    if (tok2 == 0 && !counter_name.empty())
+        _tokenizer->getSymbolDatabase()->debugMessage(tok, "for loop variable \'" + counter_name + "\' has varid 0.");
     if (tok2 == 0 || counter_varid == 0)
         return;
 
@@ -787,6 +793,10 @@ void CheckBufferOverrun::arrayIndexInForLoop(const Token *tok, const ArrayInfo &
     std::string counter_init_value;
 
     tok3 = for_init(tok3, counter_varid, counter_name, counter_init_value);
+    if (tok3 == 0 && !counter_name.empty())
+        _tokenizer->getSymbolDatabase()->debugMessage(tok, "for loop variable \'" + counter_name + "\' has varid 0.");
+    if (tok3 == 0 || counter_varid == 0)
+        return;
 
     bool maxMinFlipped = false;
     std::string min_counter_value = counter_init_value;

test/testbufferoverrun.cpp

@@ -127,6 +127,7 @@ private:
         TEST_CASE(array_index_for_neq);      // #2211: Using != in condition
         TEST_CASE(array_index_for_question); // #2561: for, ?:
         TEST_CASE(array_index_for_andand_oror);  // FN: using && or || in the for loop condition
+        TEST_CASE(array_index_for_varid0);   // #4228: No varid for counter variable
         TEST_CASE(array_index_vla_for);      // #3221: access VLA inside for
         TEST_CASE(array_index_extern);       // FP when using 'extern'. #1684
         TEST_CASE(array_index_cast);         // FP after cast. #2841
@@ -1873,6 +1874,14 @@ private:
         ASSERT_EQUALS("", errout.str());
     }
 
+    void array_index_for_varid0() { // #4228: No varid for counter variable
+        check("void f() {\n"
+              "   char a[10];\n"
+              "   for (i=0; i<10; i++);\n"
+              "}\n");
+        ASSERT_EQUALS("", errout.str());
+    }
+
     void array_index_vla_for() {
         // #3221 - access VLA inside for
         check("void f(int len) {\n"