From 9a24492a00082cd6a4e8e218afe487e36a130d21 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20Marjam=C3=A4ki?= <danielm77@spray.se>
Date: Wed, 10 Aug 2011 18:16:31 +0200
Subject: [PATCH] Fixed #2975 (False positive: Return of the address of an
 auto-variable)

---
 lib/checkautovariables.cpp |  8 ++++++++
 lib/tokenize.cpp           | 31 +++++++++++++++++--------------
 test/testautovariables.cpp | 12 ++++++++++++
 3 files changed, 37 insertions(+), 14 deletions(-)

diff --git a/lib/checkautovariables.cpp b/lib/checkautovariables.cpp
index b19d473b9..a5bcd6101 100644
--- a/lib/checkautovariables.cpp
+++ b/lib/checkautovariables.cpp
@@ -56,6 +56,14 @@ bool CheckAutoVariables::isAutoVar(unsigned int varId)
     if (!var || !var->isLocal() || var->isStatic() || var->isArray() || var->typeEndToken()->str() == "*")
         return false;
 
+    if (Token::simpleMatch(var->nameToken()->previous(), "&"))
+    {
+        // address of reference variable can be taken if the address
+        // of the variable it points at is not a auto-var
+        // TODO: check what the reference variable references.
+        return false;
+    }
+
     return true;
 }
 
diff --git a/lib/tokenize.cpp b/lib/tokenize.cpp
index a889661e8..a5bac4557 100644
--- a/lib/tokenize.cpp
+++ b/lib/tokenize.cpp
@@ -2082,20 +2082,23 @@ void Tokenizer::simplifyMulAnd(void)
 {
     for (Token *tok = _tokens; tok; tok = tok->next())
     {
-        //fix Ticket #2784
-        if (Token::Match(tok->next(), "* & %any% ="))
+        if (Token::Match(tok, "[;{}] *"))
         {
-            tok->deleteNext(); //del *
-            tok->deleteNext(); //del &
-            continue;
-        }
-        if (Token::Match(tok->next(), "* ( & %any% ) ="))
-        {
-            tok->deleteNext(); //del *
-            tok->deleteNext(); //del (
-            tok->deleteNext(); //del &
-            tok->next()->deleteNext(); //del )
-            continue;
+            //fix Ticket #2784
+            if (Token::Match(tok->next(), "* & %any% ="))
+            {
+                tok->deleteNext(); //del *
+                tok->deleteNext(); //del &
+                continue;
+            }
+            if (Token::Match(tok->next(), "* ( & %any% ) ="))
+            {
+                tok->deleteNext(); //del *
+                tok->deleteNext(); //del (
+                tok->deleteNext(); //del &
+                tok->next()->deleteNext(); //del )
+                continue;
+            }
         }
     }
 }
@@ -2115,7 +2118,7 @@ bool Tokenizer::tokenize(std::istream &code,
 
     createTokens(code);
 
-    // simplify '* & %any% =' to '%any% ='
+    // simplify '[;{}] * & %any% =' to '%any% ='
     simplifyMulAnd();
 
     // Convert C# code
diff --git a/test/testautovariables.cpp b/test/testautovariables.cpp
index 5a7bf0503..89f34dfae 100644
--- a/test/testautovariables.cpp
+++ b/test/testautovariables.cpp
@@ -77,6 +77,7 @@ private:
         TEST_CASE(testautovar_array2);
         TEST_CASE(testautovar_return1);
         TEST_CASE(testautovar_return2);
+        TEST_CASE(testautovar_return3);
         TEST_CASE(testautovar_extern);
         TEST_CASE(testinvaliddealloc);
         TEST_CASE(testassign1);  // Ticket #1819
@@ -257,6 +258,17 @@ private:
         ASSERT_EQUALS("[test.cpp:6]: (error) Return of the address of an auto-variable\n", errout.str());
     }
 
+    void testautovar_return3()
+    {
+        // #2975 - FP
+        check("void** f()\n"
+              "{\n"
+              "    void *&value = tls[id];"
+              "    return &value;"
+              "}");
+        ASSERT_EQUALS("", errout.str());
+    }
+
     void testautovar_extern()
     {
         check("struct foo *f()\n"