From d3c20cac813bf51d7e58c13b0d47291d45c33216 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20Marjam=C3=A4ki?= <danielm77@spray.se>
Date: Thu, 27 May 2010 19:00:52 +0200
Subject: [PATCH] Fixed #1712 (False negative: dereferencing uninitialized
 pointer)

---
 lib/executionpath.cpp | 10 +++++++---
 test/testother.cpp    |  9 +++++++++
 2 files changed, 16 insertions(+), 3 deletions(-)

diff --git a/lib/executionpath.cpp b/lib/executionpath.cpp
index 05c1297b4..5ccbcfe2f 100644
--- a/lib/executionpath.cpp
+++ b/lib/executionpath.cpp
@@ -245,16 +245,20 @@ static void checkExecutionPaths_(const Token *tok, std::list<ExecutionPath *> &c
                         std::list<ExecutionPath *>::const_iterator it;
                         for (it = checks.begin(); it != checks.end(); ++it)
                         {
+                            c.push_back((*it)->copy());
                             if ((*it)->varId != 0)
-                            {
-                                c.push_back((*it)->copy());
                                 countif2.insert((*it)->varId);
-                            }
                         }
                     }
                     checkExecutionPaths_(tok->next(), c);
                     while (!c.empty())
                     {
+                        if (c.back()->varId == 0)
+                        {
+                            c.pop_back();
+                            continue;
+                        }
+
                         bool duplicate = false;
                         std::list<ExecutionPath *>::const_iterator it;
                         for (it = checks.begin(); it != checks.end(); ++it)
diff --git a/test/testother.cpp b/test/testother.cpp
index e861ba823..6abf89ae9 100644
--- a/test/testother.cpp
+++ b/test/testother.cpp
@@ -1411,6 +1411,15 @@ private:
                        "}\n");
         ASSERT_EQUALS("", errout.str());
 
+        checkNullPointer("void f(int a)\n"
+                         "{\n"
+                         "    if (a) {\n"
+                         "        char *p;\n"
+                         "        *p = 0;\n"
+                         "    }\n"
+                         "}\n");
+        ASSERT_EQUALS("[test.cpp:5]: (error) Uninitialized variable: p\n", errout.str());
+
         // +=
         checkUninitVar("void f()\n"
                        "{\n"