Verification; Experimental checking for uninit

lib/exprengine.cpp

@@ -1698,6 +1698,20 @@ void ExprEngine::runChecks(ErrorLogger *errorLogger, const Tokenizer *tokenizer,
     };
 #endif
 
+#ifdef VERIFY_UNINIT  // This is highly experimental
+    std::function<void(const Token *, const ExprEngine::Value &, ExprEngine::DataBase *)> uninit = [=](const Token *tok, const ExprEngine::Value &value, ExprEngine::DataBase *dataBase) {
+        if (!tok->astParent())
+            return;
+        if (!value.isUninit())
+            return;
+
+        dataBase->addError(tok->linenr());
+        std::list<const Token*> callstack{tok};
+        ErrorLogger::ErrorMessage errmsg(callstack, &tokenizer->list, Severity::SeverityType::error, "verificationUninit", "Cannot determine that data is initialized", CWE(908), false);
+        errorLogger->reportErr(errmsg);
+    };
+#endif
+
     std::function<void(const Token *, const ExprEngine::Value &, ExprEngine::DataBase *)> checkFunctionCall = [=](const Token *tok, const ExprEngine::Value &value, ExprEngine::DataBase *dataBase) {
         if (!Token::Match(tok->astParent(), "[(,]"))
             return;
@@ -1800,6 +1814,9 @@ void ExprEngine::runChecks(ErrorLogger *errorLogger, const Tokenizer *tokenizer,
 #ifdef VERIFY_INTEGEROVERFLOW
     callbacks.push_back(integerOverflow);
 #endif
+#ifdef VERIFY_UNINIT
+    callbacks.push_back(uninit);
+#endif
 
     std::ostringstream report;
     ExprEngine::executeAllFunctions(tokenizer, settings, callbacks, report);

lib/exprengine.h

@@ -105,6 +105,9 @@ namespace ExprEngine {
             (void)value;
             return false;
         }
+        virtual bool isUninit() const {
+            return false;
+        }
 
         const std::string name;
         ValueType type;
@@ -113,6 +116,9 @@ namespace ExprEngine {
     class UninitValue: public Value {
     public:
         UninitValue() : Value("?", ValueType::UninitValue) {}
+        bool isUninit() const OVERRIDE {
+            return true;
+        }
     };
 
     class IntRange : public Value {

test/testsuites/danmar-verify/uninit.c

@@ -0,0 +1,7 @@
+
+void foo() {
+    int a[10];
+    a[0] = 0;
+    return a[2];
+}
+