From be2824b0030fbdf13731e8414b0af75e7d08e1e4 Mon Sep 17 00:00:00 2001
From: chrchr-github <78114321+chrchr-github@users.noreply.github.com>
Date: Thu, 8 Jun 2023 07:55:49 +0200
Subject: [PATCH] Fix FN deallocuse with array access (#5121)

* Fix FN deallocuse with array access

* Fix another FN

* Undo
---
 lib/checkleakautovar.cpp |  5 ++++-
 test/testleakautovar.cpp | 15 +++++++++++++++
 2 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/lib/checkleakautovar.cpp b/lib/checkleakautovar.cpp
index 9fbee0a64..6e6036f6b 100644
--- a/lib/checkleakautovar.cpp
+++ b/lib/checkleakautovar.cpp
@@ -326,6 +326,9 @@ bool CheckLeakAutoVar::checkScope(const Token * const startToken,
         if (!Token::Match(tok, "[;{},]") || Token::Match(tok->next(), "[;{},]"))
             continue;
 
+        if (Token::Match(tok, "[;{},] %var% ["))
+            continue;
+
         tok = tok->next();
         if (!tok || tok == endToken)
             break;
@@ -1067,7 +1070,7 @@ void CheckLeakAutoVar::ret(const Token *tok, VarInfo &varInfo, const bool isEndO
                     tok2 = tok3->tokAt(4);
                 else
                     continue;
-                if (Token::Match(tok2, "[});,+]")) {
+                if (Token::Match(tok2, "[});,+[]")) {
                     used = true;
                     break;
                 }
diff --git a/test/testleakautovar.cpp b/test/testleakautovar.cpp
index 85ce36111..a873e469c 100644
--- a/test/testleakautovar.cpp
+++ b/test/testleakautovar.cpp
@@ -111,6 +111,7 @@ private:
         TEST_CASE(deallocuse7); // #6467, #6469, #6473
         TEST_CASE(deallocuse8); // #1765
         TEST_CASE(deallocuse9); // #9781
+        TEST_CASE(deallocuse10);
 
         TEST_CASE(doublefree1);
         TEST_CASE(doublefree2);
@@ -825,6 +826,20 @@ private:
         ASSERT_EQUALS("", errout.str());
     }
 
+    void deallocuse10() {
+        check("void f(char* p) {\n"
+              "    free(p);\n"
+              "    p[0] = 10;\n"
+              "}\n");
+        ASSERT_EQUALS("[test.c:3]: (error) Dereferencing 'p' after it is deallocated / released\n", errout.str());
+
+        check("int f(int* p) {\n"
+              "    free(p);\n"
+              "    return p[1];\n"
+              "}\n");
+        ASSERT_EQUALS("[test.c:2] -> [test.c:3]: (error) Returning/dereferencing 'p' after it is deallocated / released\n", errout.str());
+    }
+
     void doublefree1() {  // #3895
         check("void f(char *p) {\n"
               "    if (x)\n"