From 79a2e61721bf8c310c3bf463f0f5a8814ac7ae89 Mon Sep 17 00:00:00 2001
From: Paul Fultz II <pfultz2@yahoo.com>
Date: Sat, 30 Nov 2019 02:22:03 -0600
Subject: [PATCH] Fix issue 6850: Valueflow: pointer alias, conditional value
 (#2402)

---
 lib/valueflow.cpp        |  3 +++
 test/testnullpointer.cpp | 10 ++++++++++
 2 files changed, 13 insertions(+)

diff --git a/lib/valueflow.cpp b/lib/valueflow.cpp
index 9ab440f84..feec36dca 100644
--- a/lib/valueflow.cpp
+++ b/lib/valueflow.cpp
@@ -1698,6 +1698,9 @@ static void valueFlowReverse(TokenList *tokenlist,
                                      tokenlist,
                                      errorLogger,
                                      settings);
+                    // Only reverse analysis supported with variables
+                    if (assignTok->varId() > 0)
+                        valueFlowReverse(tokenlist, tok2->previous(), assignTok, val, val2, errorLogger, settings);
                 }
                 if (settings->debugwarnings)
                     bailout(tokenlist, errorLogger, tok2, "assignment of " + tok2->str());
diff --git a/test/testnullpointer.cpp b/test/testnullpointer.cpp
index a74c57cb2..01723cdef 100644
--- a/test/testnullpointer.cpp
+++ b/test/testnullpointer.cpp
@@ -85,6 +85,7 @@ private:
         TEST_CASE(nullpointer43); // #9404
         TEST_CASE(nullpointer44); // #9395, #9423
         TEST_CASE(nullpointer45);
+        TEST_CASE(nullpointer46); // #6850
         TEST_CASE(nullpointer_addressOf); // address of
         TEST_CASE(nullpointerSwitch); // #2626
         TEST_CASE(nullpointer_cast); // #4692
@@ -1613,6 +1614,15 @@ private:
         ASSERT_EQUALS("", errout.str());
     }
 
+    void nullpointer46() {
+        check("void f(int *p) {\n"
+              "   if(!p[0]) {}\n"
+              "   const int *const a = p;\n"
+              "   if(!a){}\n"
+              "}\n");
+        ASSERT_EQUALS("[test.cpp:4] -> [test.cpp:2]: (warning) Either the condition '!a' is redundant or there is possible null pointer dereference: p.\n", errout.str());
+    }
+
     void nullpointer_addressOf() { // address of
         check("void f() {\n"
               "  struct X *x = 0;\n"