From 9a4707c025fc4c5597014a7cc7b98465713878e9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20Marjam=C3=A4ki?= <danielm77@spray.se>
Date: Thu, 8 Apr 2010 19:57:38 +0200
Subject: [PATCH] Fixed #1576 ('Index out of bounds' false positive)

---
 lib/checkbufferoverrun.cpp |  7 +++++++
 test/testbufferoverrun.cpp | 19 +++++++++++++++++++
 2 files changed, 26 insertions(+)

diff --git a/lib/checkbufferoverrun.cpp b/lib/checkbufferoverrun.cpp
index 722c6a1da..ecde2cff3 100644
--- a/lib/checkbufferoverrun.cpp
+++ b/lib/checkbufferoverrun.cpp
@@ -968,6 +968,13 @@ void CheckBufferOverrun::checkStructVariable()
         // Found a struct declaration. Search for arrays..
         for (const Token *tok2 = tok->tokAt(2); tok2; tok2 = tok2->next())
         {
+            // skip inner scopes..
+            if (tok2->next() && tok2->next()->str() == "{")
+            {
+                tok2 = tok2->next()->link();
+                continue;
+            }
+
             if (tok2->str() == "}")
                 break;
 
diff --git a/test/testbufferoverrun.cpp b/test/testbufferoverrun.cpp
index 2d430acb2..6aaabee14 100644
--- a/test/testbufferoverrun.cpp
+++ b/test/testbufferoverrun.cpp
@@ -101,6 +101,7 @@ private:
         TEST_CASE(array_index_calculation);
         TEST_CASE(array_index_negative);
         TEST_CASE(array_index_for_decr);
+        TEST_CASE(array_index_varnames);   // FP: struct member. #1576
 
         TEST_CASE(buffer_overrun_1);
         TEST_CASE(buffer_overrun_2);
@@ -1012,6 +1013,24 @@ private:
         TODO_ASSERT_EQUALS("[test.cpp:5]: (error) Array 'val[5]' index -1 out of bounds\n", errout.str());
     }
 
+
+    void array_index_varnames()
+    {
+        check("struct A {\n"
+              "    char data[4];\n"
+              "    struct B { char data[3]; };\n"
+              "    B b;\n"
+              "};\n"
+              "\n"
+              "void f()\n"
+              "{\n"
+              "    A a;\n"
+              "    a.data[3] = 0;\n"
+              "}\n");
+        ASSERT_EQUALS("", errout.str());
+    }
+
+
     void buffer_overrun_1()
     {
         check("void f()\n"