Fixed #2975 (False positive: Return of the address of an auto-variable)

lib/checkautovariables.cpp

@@ -56,6 +56,14 @@ bool CheckAutoVariables::isAutoVar(unsigned int varId)
     if (!var || !var->isLocal() || var->isStatic() || var->isArray() || var->typeEndToken()->str() == "*")
         return false;
 
+    if (Token::simpleMatch(var->nameToken()->previous(), "&"))
+    {
+        // address of reference variable can be taken if the address
+        // of the variable it points at is not a auto-var
+        // TODO: check what the reference variable references.
+        return false;
+    }
+
     return true;
 }
 

lib/tokenize.cpp

@@ -2081,6 +2081,8 @@ void Tokenizer::simplifyTypedef()
 void Tokenizer::simplifyMulAnd(void)
 {
     for (Token *tok = _tokens; tok; tok = tok->next())
+    {
+        if (Token::Match(tok, "[;{}] *"))
         {
             //fix Ticket #2784
             if (Token::Match(tok->next(), "* & %any% ="))
@@ -2098,6 +2100,7 @@ void Tokenizer::simplifyMulAnd(void)
                 continue;
             }
         }
+    }
 }
 
 bool Tokenizer::tokenize(std::istream &code,
@@ -2115,7 +2118,7 @@ bool Tokenizer::tokenize(std::istream &code,
 
     createTokens(code);
 
-    // simplify '* & %any% =' to '%any% ='
+    // simplify '[;{}] * & %any% =' to '%any% ='
     simplifyMulAnd();
 
     // Convert C# code

test/testautovariables.cpp

@@ -77,6 +77,7 @@ private:
         TEST_CASE(testautovar_array2);
         TEST_CASE(testautovar_return1);
         TEST_CASE(testautovar_return2);
+        TEST_CASE(testautovar_return3);
         TEST_CASE(testautovar_extern);
         TEST_CASE(testinvaliddealloc);
         TEST_CASE(testassign1);  // Ticket #1819
@@ -257,6 +258,17 @@ private:
         ASSERT_EQUALS("[test.cpp:6]: (error) Return of the address of an auto-variable\n", errout.str());
     }
 
+    void testautovar_return3()
+    {
+        // #2975 - FP
+        check("void** f()\n"
+              "{\n"
+              "    void *&value = tls[id];"
+              "    return &value;"
+              "}");
+        ASSERT_EQUALS("", errout.str());
+    }
+
     void testautovar_extern()
     {
         check("struct foo *f()\n"