From 6c0a5a5859d06e40e78d27e77e8d567c2461b971 Mon Sep 17 00:00:00 2001
From: Paul Fultz II <pfultz2@yahoo.com>
Date: Sat, 2 Sep 2023 07:28:54 -0500
Subject: [PATCH] Fix 11894: FPs knownArgument with sizeof and function pointer
 (#5396)

---
 lib/checkother.cpp | 12 +++++++++---
 test/testother.cpp | 12 ++++++++++++
 2 files changed, 21 insertions(+), 3 deletions(-)

diff --git a/lib/checkother.cpp b/lib/checkother.cpp
index e75688e95..66954f066 100644
--- a/lib/checkother.cpp
+++ b/lib/checkother.cpp
@@ -3764,11 +3764,17 @@ void CheckOther::checkKnownArgument()
                     mTokenizer->isCPP(), true, tok->astOperand1(), tok->astOperand2(), mSettings->library, true, true))
                 continue;
             // ensure that there is a integer variable in expression with unknown value
-            const Token* vartok = findAstNode(tok, [](const Token* child) {
+            const Token* vartok = nullptr;
+            visitAstNodes(tok, [&](const Token* child) {
                 if (Token::Match(child, "%var%|.|[")) {
-                    return astIsIntegral(child, false) && !astIsPointer(child) && child->values().empty();
+                    if (child->hasKnownIntValue())
+                        return ChildrenToVisit::none;
+                    if (astIsIntegral(child, false) && !astIsPointer(child) && child->values().empty()) {
+                        vartok = child;
+                        return ChildrenToVisit::done;
+                    }
                 }
-                return false;
+                return ChildrenToVisit::op1_and_op2;
             });
             if (!vartok)
                 continue;
diff --git a/test/testother.cpp b/test/testother.cpp
index 4f5782e6d..3d9f24be6 100644
--- a/test/testother.cpp
+++ b/test/testother.cpp
@@ -11033,6 +11033,18 @@ private:
               "}");
         ASSERT_EQUALS("", errout.str());
 
+        // #11894
+        check("struct S {\n"
+              "    int *p, n;\n"
+              "};\n"
+              "S* g() {\n"
+              "    S* s = static_cast<S*>(calloc(1, sizeof(S)));\n"
+              "    s->n = 100;\n"
+              "    s->p = static_cast<int*>(malloc(s->n * sizeof(int)));\n"
+              "    return s;\n"
+              "}\n");
+        ASSERT_EQUALS("", errout.str());
+
         // #11679
         check("bool g(int);\n"
               "void h(int);\n"