Fixed #6002 (Defect: False positive due to pointer address not being associated with variable in for loop)

lib/valueflow.cpp

@@ -946,6 +946,20 @@ static bool valueFlowForward(Token * const               startToken,
                     setTokenValue(tok2, *it);
             }
 
+            // bailout if address of var is taken..
+            if (tok2->astParent() && tok2->astParent()->str() == "&" && !tok2->astParent()->astOperand2()) {
+                if (settings->debugwarnings)
+                    bailout(tokenlist, errorLogger, tok2, "Taking address of " + tok2->str());
+                return false;
+            }
+
+            // bailout if reference is created..
+            if (tok2->astParent() && Token::Match(tok2->astParent()->tokAt(-2), "& %var% =")) {
+                if (settings->debugwarnings)
+                    bailout(tokenlist, errorLogger, tok2, "Reference of " + tok2->str());
+                return false;
+            }
+
             // assigned by subfunction?
             bool inconclusive = false;
             if (bailoutFunctionPar(tok2, ValueFlow::Value(), settings, &inconclusive)) {

test/testvalueflow.cpp

@@ -834,6 +834,27 @@ private:
                "}";
         ASSERT_EQUALS(false, testValueOfX(code, 6U, 3));
 
+        // pointer/reference to x
+        code = "int f(void) {\n"
+               "  int x = 2;\n"
+               "  int *px = &x;\n"
+               "  for (int i = 0; i < 1; i++) {\n"
+               "    *px = 1;\n"
+               "  }\n"
+               "  return x;\n"
+               "}";
+        ASSERT_EQUALS(false, testValueOfX(code, 7U, 2));
+
+        code = "int f(void) {\n"
+               "  int x = 5;\n"
+               "  int &rx = x;\n"
+               "  for (int i = 0; i < 1; i++) {\n"
+               "    rx = 1;\n"
+               "  }\n"
+               "  return x;\n"
+               "}";
+        ASSERT_EQUALS(false, testValueOfX(code, 7U, 5));
+
         // break
         code = "void f() {\n"
                "  for (;;) {\n"