Fixed #6867 (False positive memleak)

lib/checkleakautovar.cpp

@@ -288,19 +288,38 @@ void CheckLeakAutoVar::checkScope(const Token * const startToken,
                 VarInfo varInfo1(*varInfo);  // VarInfo for if code
                 VarInfo varInfo2(*varInfo);  // VarInfo for else code
 
-                const Token *vartok = nullptr;
+                // Recursively scan variable comparisons in condition
-                if (Token::findVariableComparison(tok->next()->astOperand2(), "!=", "0", &vartok)) {
+                std::stack<const Token *> tokens;
-                    varInfo2.erase(vartok->varId());
+                tokens.push(tok->next()->astOperand2());
-                    if (notzero.find(vartok->varId()) != notzero.end())
+                while (!tokens.empty()) {
-                        varInfo2.clear();
+                    const Token *tok3 = tokens.top();
-                } else if (Token::findVariableComparison(tok->next()->astOperand2(), "==", "0", &vartok)) {
+                    tokens.pop();
-                    varInfo1.erase(vartok->varId());
+                    if (!tok3)
-                } else if (Token::findVariableComparison(tok->next()->astOperand2(), "<", "0", &vartok)) {
+                        continue;
-                    varInfo1.erase(vartok->varId());
+                    if (tok3->str() == "&&") {
-                } else if (Token::findVariableComparison(tok->next()->astOperand2(), ">", "0", &vartok)) {
+                        tokens.push(tok3->astOperand1());
-                    varInfo2.erase(vartok->varId());
+                        tokens.push(tok3->astOperand2());
-                } else if (Token::findVariableComparison(tok->next()->astOperand2(), "==", "-1", &vartok)) {
+                        continue;
-                    varInfo1.erase(vartok->varId());
+                    }
+                    if (tok3->str() == "(" && Token::Match(tok3->astOperand1(), "UNLIKELY|LIKELY")) {
+                        tokens.push(tok3->astOperand2());
+                        continue;
+                    }
+
+                    const Token *vartok = nullptr;
+                    if (Token::isVariableComparison(tok3, "!=", "0", &vartok)) {
+                        varInfo2.erase(vartok->varId());
+                        if (notzero.find(vartok->varId()) != notzero.end())
+                            varInfo2.clear();
+                    } else if (Token::isVariableComparison(tok3, "==", "0", &vartok)) {
+                        varInfo1.erase(vartok->varId());
+                    } else if (Token::isVariableComparison(tok3, "<", "0", &vartok)) {
+                        varInfo1.erase(vartok->varId());
+                    } else if (Token::isVariableComparison(tok3, ">", "0", &vartok)) {
+                        varInfo2.erase(vartok->varId());
+                    } else if (Token::isVariableComparison(tok3, "==", "-1", &vartok)) {
+                        varInfo1.erase(vartok->varId());
+                    }
                 }
 
                 checkScope(tok2->next(), &varInfo1, notzero);

lib/checkmemoryleak.cpp

@@ -519,11 +519,13 @@ const char *CheckMemoryLeak::functionArgAlloc(const Function *func, unsigned int
 
 static bool notvar(const Token *tok, unsigned int varid)
 {
+    if (!tok)
+        return false;
     if (Token::Match(tok, "&&|;"))
         return notvar(tok->astOperand1(),varid) || notvar(tok->astOperand2(),varid);
-
+    if (tok->str() == "(" && Token::Match(tok->astOperand1(), "UNLIKELY|LIKELY"))
-    const Token *vartok = Token::findVariableComparison(tok, "==", "0");
+        return notvar(tok->astOperand2(), varid);
-
+    const Token *vartok = Token::isVariableComparison(tok, "==", "0");
     return vartok && (vartok->varId() == varid);
 }
 
@@ -531,11 +533,13 @@ static bool ifvar(const Token *tok, unsigned int varid, const std::string &comp,
 {
     if (!Token::simpleMatch(tok, "if ("))
         return false;
-    const Token * const condition = tok->next()->astOperand2();
+    const Token *condition = tok->next()->astOperand2();
+    if (condition && condition->str() == "(" && Token::Match(condition->astOperand1(), "UNLIKELY|LIKELY"))
+        condition = condition->astOperand2();
     if (!condition || condition->str() == "&&")
         return false;
-    const Token *vartok = nullptr;
+
-    Token::findVariableComparison(condition, comp, rhs, &vartok);
+    const Token *vartok = Token::isVariableComparison(condition, comp, rhs);
     return (vartok && vartok->varId() == varid);
 }
 

lib/token.cpp

@@ -1460,21 +1460,11 @@ const Token *Token::getValueTokenDeadPointer() const
 }
 
 
-const Token * Token::findVariableComparison(const Token *tok, const std::string &comp, const std::string &rhs, const Token **vartok)
+const Token * Token::isVariableComparison(const Token *tok, const std::string &comp, const std::string &rhs, const Token **vartok)
 {
     if (!tok)
         return nullptr;
 
-    if (tok->str() == "&&") {
-        const Token *ret = findVariableComparison(tok->astOperand1(), comp, rhs, vartok);
-        if (!ret)
-            ret = findVariableComparison(tok->astOperand2(), comp, rhs, vartok);
-        return ret;
-    }
-
-    if (tok->str() == "(" && tok->astOperand2() && Token::Match(tok->astOperand1(), "UNLIKELY|LIKELY"))
-        return findVariableComparison(tok->astOperand2(), comp, rhs, vartok);
-
     const Token *ret = nullptr;
     if (tok->isComparisonOp()) {
         if (tok->astOperand1() && tok->astOperand1()->str() == rhs) {

lib/token.h

@@ -717,8 +717,8 @@ public:
 
     const Token *getValueTokenDeadPointer() const;
 
-    /** Recursively search for variable comparison against value */
+    /** Is given syntax tree a variable comparison against value */
-    static const Token * findVariableComparison(const Token *tok, const std::string &comp, const std::string &rhs, const Token **vartok=nullptr);
+    static const Token * isVariableComparison(const Token *tok, const std::string &comp, const std::string &rhs, const Token **vartok=nullptr);
 
 private:
 

test/testleakautovar.cpp

@@ -869,6 +869,14 @@ private:
               "}");
         ASSERT_EQUALS("", errout.str());
 
+        check("char * f(size_t size) {"
+              "    void *p = malloc(1);"
+              "    if (!p && size != 0)"
+              "        return NULL;"
+              "    return p;"
+              "}");
+        ASSERT_EQUALS("", errout.str());
+
         check("void f() {\n"
               "    char *p = malloc(10);\n"
               "    if (p) { } else { return; }\n"