code cleanups and refactorings

lib/check64bit.cpp

@@ -34,7 +34,7 @@ namespace {
 static bool isaddr(const Variable *var)
 {
     const Token *nametok = var ? var->nameToken() : 0;
-    return (var && (nametok->strAt(-1) == "*" || nametok->strAt(1) == "["));
+    return (var && (nametok->strAt(-2) == "*" || nametok->strAt(-1) == "*" || nametok->strAt(1) == "["));
 }
 
 /** Is given variable an integer variable */

lib/checkother.cpp

@@ -1119,25 +1119,24 @@ void CheckOther::invalidFunctionUsage()
 
         // goto ","
         const Token *tok2 = tok->tokAt(3);
-        while (tok2 && tok2->str() != ",")
+        while (tok2->str() != ",")
             tok2 = tok2->next();
-        if (!tok2)
-            continue;
+
+        tok2 = tok2->next(); // Jump behind ","
+
+        if (tok->str() == "snprintf") { // Jump over second parameter for snprintf
+            tok2 = tok2->nextArgument();
+            if (!tok2)
+                continue;
+        }
 
         // is any source buffer overlapping the target buffer?
-        unsigned int parlevel = 0;
-        while ((tok2 = tok2->next()) != NULL) {
-            if (tok2->str() == "(")
-                ++parlevel;
-            else if (tok2->str() == ")") {
-                if (!parlevel)
-                    break;
-                --parlevel;
-            } else if (parlevel == 0 && Token::Match(tok2, ", %varid% [,)]", varid)) {
+        do {
+            if (Token::Match(tok2, "%varid% [,)]", varid)) {
                 sprintfOverlappingDataError(tok2->next(), tok2->next()->str());
                 break;
             }
-        }
+        } while ((tok2 = tok2->nextArgument()) != NULL);
     }
 }
 
@@ -1167,9 +1166,13 @@ void CheckOther::invalidScanf()
         const Token *formatToken = 0;
         if (Token::Match(tok, "scanf|vscanf ( %str% ,"))
             formatToken = tok->tokAt(2);
-        else if (Token::Match(tok, "fscanf|vfscanf ( %var% , %str% ,"))
-            formatToken = tok->tokAt(4);
-        else
+        else if (Token::Match(tok, "fscanf|vfscanf (")) {
+            const Token* nextArg = tok->tokAt(2)->nextArgument();
+            if (nextArg && Token::Match(nextArg, "%str%"))
+                formatToken = nextArg;
+            else
+                continue;
+        } else
             continue;
 
         bool format = false;
@@ -1776,7 +1779,7 @@ void CheckOther::checkCharVariable()
 
     for (const Token *tok = _tokenizer->tokens(); tok; tok = tok->next()) {
         // Declaring the variable..
-        if (Token::Match(tok, "[{};(,] const| char *| %var% [;=,)]") ||
+        if (Token::Match(tok, "[{};(,] const| char *| const| %var% [;=,)]") ||
             Token::Match(tok, "[{};(,] const| char %var% [")) {
             // goto 'char' token
             tok = tok->next();
@@ -1792,6 +1795,8 @@ void CheckOther::checkCharVariable()
             const bool isPointer(tok->str() == "*" || tok->strAt(1) == "[");
             if (tok->str() == "*")
                 tok = tok->next();
+            if (tok->str() == "const")
+                tok = tok->next();
 
             const unsigned int varid = tok->varId();
             if (!varid)

test/testnullpointer.cpp

@@ -47,6 +47,7 @@ private:
         TEST_CASE(nullpointer11); // ticket #2812
         TEST_CASE(nullpointer12); // ticket #2470
         TEST_CASE(nullpointer13); // ticket #1708
+        TEST_CASE(nullpointer14);
         TEST_CASE(pointerCheckAndDeRef);     // check if pointer is null and then dereference it
         TEST_CASE(nullConstantDereference);  // Dereference NULL constant
         TEST_CASE(gcc_statement_expression); // Don't crash
@@ -1111,6 +1112,20 @@ private:
         ASSERT_EQUALS("[test.cpp:10]: (error) Null pointer dereference\n", errout.str());
     }
 
+    void nullpointer14() {
+        check("void foo()\n"
+              "{\n"
+              "  strcpy(bar, 0);\n"
+              "}\n");
+        ASSERT_EQUALS("[test.cpp:3]: (error) Null pointer dereference\n", errout.str());
+
+        check("void foo()\n"
+              "{\n"
+              "  memcmp(bar(xyz()), 0, 123);\n"
+              "}\n");
+        ASSERT_EQUALS("[test.cpp:3]: (error) Null pointer dereference\n", errout.str());
+    }
+
     // Check if pointer is null and the dereference it
     void pointerCheckAndDeRef() {
         check("void foo(char *p) {\n"