CheckMemoryLeak: Fix FP for allocation functions that register memory before returning it

lib/checkmemoryleak.cpp

@@ -449,8 +449,11 @@ CheckMemoryLeak::AllocType CheckMemoryLeak::functionReturnType(const Function* f
         if (Token::Match(tok, "[(,] %varid% [,)]", varid)) {
             return No;
         }
-        if (tok->str() == "return")
-            return allocType;
+        if (Token::Match(tok, "[(,] & %varid% [.,)]", varid)) {
+            return No;
+        }
+        if (allocType == No && tok->str() == "return")
+            return No;
     }
 
     return allocType;

test/testmemleak.cpp

@@ -253,6 +253,7 @@ private:
         TEST_CASE(allocfunc11);
         TEST_CASE(allocfunc12); // #3660: allocating and returning non-local pointer => not allocfunc
         TEST_CASE(allocfunc13); // Ticket #4494 and #4540 - class function
+        TEST_CASE(allocfunc14); // Use pointer before returning it
 
         TEST_CASE(throw1);
         TEST_CASE(throw2);
@@ -2827,6 +2828,19 @@ private:
         ASSERT_EQUALS("[test.cpp:11]: (error) Memory leak: a\n", errout.str());
     }
 
+    void allocfunc14() { // use pointer before returning it
+        check("static struct ABC * newabc() {\n"
+              "    struct ABC *abc = malloc(sizeof(struct ABC));\n"
+              "    init_abc(&abc->a);\n" // <- might take address
+              "    return abc;\n"
+              "}\n"
+              "\n"
+              "static void f() {\n"
+              "    struct ABC *abc = newabc();\n"
+              "}");
+        ASSERT_EQUALS("", errout.str());
+    }
+
     void throw1() {
         check("void foo()\n"
               "{\n"

test/testother.cpp

@@ -5490,7 +5490,7 @@ private:
               "   std::cout << 3 << -1 ;\n"
               "}");
         ASSERT_EQUALS("", errout.str());
-        
+
         check("x = y ? z << $-1 : 0;\n");
         ASSERT_EQUALS("", errout.str());
     }