Fixed #1188 (false negative: dereferencing p, which is a null pointer 'int y = 5 + *p')

This commit is contained in:
Daniel Marjamäki 2009-12-31 20:00:20 +01:00
parent e0ecef5d71
commit 7ecd333ffa
2 changed files with 15 additions and 3 deletions

View File

@ -1265,11 +1265,15 @@ private:
{
if (Token::Match(tok.previous(), "[;{}=] %var% = 0 ;"))
setnull(checks, tok.varId());
else if (Token::Match(tok.tokAt(-2), "[;{}=] * %var%"))
else if (Token::Match(tok.tokAt(-2), "[;{}=+-/(,] * %var%"))
dereference(foundError, checks, &tok);
else if (Token::Match(tok.tokAt(-2), "return * %var%"))
dereference(foundError, checks, &tok);
else if (Token::Match(tok.next(), ". %var%"))
dereference(foundError, checks, &tok);
else if (Token::Match(tok.previous(), "[;{}] %var% [ %num% ] ="))
else if (Token::Match(tok.previous(), "[;{}=+-/(,] %var% [ %any% ]"))
dereference(foundError, checks, &tok);
else if (Token::Match(tok.previous(), "return %var% [ %any% ]"))
dereference(foundError, checks, &tok);
else
bailOutVar(checks, tok.varId());
@ -1277,7 +1281,8 @@ private:
if (Token::simpleMatch(&tok, "* 0"))
{
if (Token::Match(tok.previous(), "[;{}=]"))
if (Token::Match(tok.previous(), "[;{}=+-/(,]") ||
Token::simpleMatch(tok.previous(), "return"))
{
CheckOther *checkOther = dynamic_cast<CheckOther *>(owner);
if (checkOther)

View File

@ -922,6 +922,13 @@ private:
"}\n");
ASSERT_EQUALS("[test.cpp:4]: (error) Null pointer dereference\n", errout.str());
checkNullPointer("static void foo(int x)\n"
"{\n"
" int *p = 0;\n"
" int y = 5 + *p;\n"
"}\n");
ASSERT_EQUALS("[test.cpp:4]: (error) Null pointer dereference\n", errout.str());
// no false positive..
checkNullPointer("static void foo()\n"
"{\n"