From e2dd085b6066e8d9f4501ac57d4f1966b9e7e353 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20Marjam=C3=A4ki?= <danielm77@spray.se>
Date: Thu, 8 Dec 2011 19:30:14 +0100
Subject: [PATCH] Fixed #3394 (False positive: possible null pointer
 dereference)

---
 lib/checknullpointer.cpp | 8 +++++++-
 test/testnullpointer.cpp | 6 ++++++
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/lib/checknullpointer.cpp b/lib/checknullpointer.cpp
index a8d4a7cb6..24842b3fd 100644
--- a/lib/checknullpointer.cpp
+++ b/lib/checknullpointer.cpp
@@ -484,7 +484,7 @@ void CheckNullPointer::nullPointerStructByDeRefAndChec()
 
         // dereference in assignment
         else if (Token::Match(tok1, "[{};] %var% = %var% . %var%")) {
-            if (std::string(tok1->strAt(1)) == tok1->strAt(3))
+            if (tok1->strAt(1) == tok1->strAt(3))
                 continue;
             tok1 = tok1->tokAt(3);
         }
@@ -716,6 +716,12 @@ void CheckNullPointer::nullPointerByDeRefAndChec()
 
                     if (Token::Match(tok1->tokAt(-2), "%varid% = %varid% .", varid)) {
                         break;
+                    } else if (Token::simpleMatch(tok1->tokAt(-2), "* )") &&
+                               Token::Match(tok1->linkAt(-1)->tokAt(-2), "%varid% = (", tok1->varId())) {
+                        break;
+                    } else if (Token::simpleMatch(tok1->tokAt(-3), "* ) (") &&
+                               Token::Match(tok1->linkAt(-2)->tokAt(-2), "%varid% = (", tok1->varId())) {
+                        break;
                     } else if (Token::Match(tok1->previous(), "&&|%oror%")) {
                         break;
                     } else if (Token::Match(tok1->tokAt(-2), "&&|%oror% !")) {
diff --git a/test/testnullpointer.cpp b/test/testnullpointer.cpp
index 204d15135..f2f91a05d 100644
--- a/test/testnullpointer.cpp
+++ b/test/testnullpointer.cpp
@@ -316,6 +316,12 @@ private:
               "}\n");
         ASSERT_EQUALS("", errout.str());
 
+        check("void f(struct ABC *abc) {\n"
+              "    abc = (ABC *)(abc->_next);\n"
+              "    if (abc) { }"
+              "}\n");
+        ASSERT_EQUALS("", errout.str());
+
         // reassign struct..
         check("void foo(struct ABC *abc)\n"
               "{\n"