From bfe28d3b26899fef5bca0b646a65814f7d79359c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20Marjam=C3=A4ki?= <danielm77@spray.se>
Date: Sun, 20 Feb 2011 21:24:57 +0100
Subject: [PATCH] Fixed #2597 (False positive: Buffer access out-of-bounds for
 u_char, uint*_t, ...)

---
 lib/checkbufferoverrun.cpp |  2 +-
 test/testbufferoverrun.cpp | 15 +++++++++++++++
 2 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/lib/checkbufferoverrun.cpp b/lib/checkbufferoverrun.cpp
index 4cda0ce51..ecd7aac8c 100644
--- a/lib/checkbufferoverrun.cpp
+++ b/lib/checkbufferoverrun.cpp
@@ -992,7 +992,7 @@ void CheckBufferOverrun::checkScope(const Token *tok, const std::vector<std::str
         }
 
         // Check function call..
-        if (Token::Match(tok, "%var% ("))
+        if (Token::Match(tok, "%var% (") && total_size > 0)
         {
             // No varid => function calls are not handled
             if (varid == 0)
diff --git a/test/testbufferoverrun.cpp b/test/testbufferoverrun.cpp
index ba3cf9151..ecc3c7554 100644
--- a/test/testbufferoverrun.cpp
+++ b/test/testbufferoverrun.cpp
@@ -135,6 +135,7 @@ private:
         TEST_CASE(buffer_overrun_16);
         TEST_CASE(buffer_overrun_17); // ticket #2548
         TEST_CASE(buffer_overrun_18); // ticket #2576 - for, calculation with loop variable
+        TEST_CASE(buffer_overrun_19); // #2597 - class member with unknown type
         TEST_CASE(buffer_overrun_bailoutIfSwitch);  // ticket #2378 : bailoutIfSwitch
 
         // It is undefined behaviour to point out of bounds of an array
@@ -1891,6 +1892,20 @@ private:
                            errout.str());
     }
 
+    void buffer_overrun_19() // #2597 - class member with unknown type
+    {
+        check("class A {\n"
+              "public:\n"
+              "    u8 buf[10];\n"
+              "    A();"
+              "};\n"
+              "\n"
+              "A::A() {\n"
+              "    memset(buf, 0, 10);\n"
+              "}\n");
+        ASSERT_EQUALS("", errout.str());
+    }
+
     void buffer_overrun_bailoutIfSwitch()
     {
         // No false positive