From 7afec3cf6d7e320b950739db55509b5ef819f3cb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20Marjam=C3=A4ki?= <danielm77@spray.se>
Date: Sun, 21 Aug 2011 17:49:00 +0200
Subject: [PATCH] Fixed #3032 (False positive: possible null pointer
 dereference (assignment in condition))

---
 lib/tokenize.cpp      |  2 +-
 test/testtokenize.cpp | 19 +++++++++++++++++--
 2 files changed, 18 insertions(+), 3 deletions(-)

diff --git a/lib/tokenize.cpp b/lib/tokenize.cpp
index 214d1715c..a2049bd02 100644
--- a/lib/tokenize.cpp
+++ b/lib/tokenize.cpp
@@ -7330,7 +7330,7 @@ bool Tokenizer::simplifyKnownVariablesSimplify(Token **tok2, Token *tok3, unsign
             Token::Match(tok3, ("[=+-*/%^|[] " + structname + " %varid% [=?+-*/%^|;])]").c_str(), varid) ||
             Token::Match(tok3, ("[(=+-*/%^|[] " + structname + " %varid% <<|>>").c_str(), varid) ||
             Token::Match(tok3, ("<<|>> " + structname + " %varid% %op%|;|]|)").c_str(), varid) ||
-            Token::Match(tok3->previous(), ("[=+-*/%^|[] ( " + structname + " %varid%").c_str(), varid))
+            Token::Match(tok3->previous(), ("[=+-*/%^|[] ( " + structname + " %varid% !!=").c_str(), varid))
         {
             if (value[0] == '\"')
                 break;
diff --git a/test/testtokenize.cpp b/test/testtokenize.cpp
index d0ef35440..c2607ab12 100644
--- a/test/testtokenize.cpp
+++ b/test/testtokenize.cpp
@@ -135,7 +135,8 @@ private:
         TEST_CASE(simplifyKnownVariables40);
         TEST_CASE(simplifyKnownVariables41);    // p=&x; if (p) ..
         TEST_CASE(simplifyKnownVariables42);    // ticket #2031 - known string value after strcpy
-        TEST_CASE(simplifyKnownVariablesBailOutAssign);
+        TEST_CASE(simplifyKnownVariablesBailOutAssign1);
+        TEST_CASE(simplifyKnownVariablesBailOutAssign2);
         TEST_CASE(simplifyKnownVariablesBailOutFor1);
         TEST_CASE(simplifyKnownVariablesBailOutFor2);
         TEST_CASE(simplifyKnownVariablesBailOutFor3);
@@ -2158,7 +2159,7 @@ private:
         }
     }
 
-    void simplifyKnownVariablesBailOutAssign()
+    void simplifyKnownVariablesBailOutAssign1()
     {
         const char code[] = "int foo() {\n"
                             "    int i; i = 0;\n"
@@ -2173,6 +2174,20 @@ private:
         ASSERT_EQUALS(expected, tokenizeAndStringify(code, true));
     }
 
+    void simplifyKnownVariablesBailOutAssign2()
+    {
+        // ticket #3032 - assignment in condition
+        const char code[] = "void f(struct ABC *list) {\n"
+                            "    struct ABC *last = NULL;\n"
+                            "    nr = (last = list->prev)->nr;\n"  // <- don't replace "last" with 0
+                            "}\n";
+        const char expected[] = "void f ( struct ABC * list ) {\n"
+                                "struct ABC * last ; last = 0 ;\n"
+                                "nr = ( last = list . prev ) . nr ;\n"
+                                "}";
+        ASSERT_EQUALS(expected, tokenizeAndStringify(code, true));
+    }
+
     void simplifyKnownVariablesBailOutFor1()
     {
         const char code[] = "void foo() {\n"