walkero
/
cppcheck
1
0
Fork 0
Code Issues Pull Requests Projects Releases 1 Wiki Activity

Fix 11651: FP negativeIndex with for loop (#4934)

This commit is contained in:
Paul Fultz II 2023-04-05 04:05:29 -05:00 committed by GitHub
parent 0f47948bf4
commit edfdfe658a
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 20 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
lib/valueflow.cpp
View File

@ -7042,6 +7042,8 @@ static void valueFlowForLoop(TokenList *tokenlist, SymbolDatabase* symboldatabas
for (const auto& p : mem1) {
if (!p.second.isIntValue())
continue;
if (p.second.isImpossible())
continue;
if (p.first.tok->varId() == 0)
continue;
valueFlowForLoopSimplify(bodyStart, p.first.tok, false, p.second.intvalue, tokenlist, errorLogger, settings);
@ -7049,6 +7051,8 @@ static void valueFlowForLoop(TokenList *tokenlist, SymbolDatabase* symboldatabas
for (const auto& p : mem2) {
if (!p.second.isIntValue())
continue;
if (p.second.isImpossible())
continue;
if (p.first.tok->varId() == 0)
continue;
valueFlowForLoopSimplify(bodyStart, p.first.tok, false, p.second.intvalue, tokenlist, errorLogger, settings);
@ -7056,6 +7060,8 @@ static void valueFlowForLoop(TokenList *tokenlist, SymbolDatabase* symboldatabas
for (const auto& p : memAfter) {
if (!p.second.isIntValue())
continue;
if (p.second.isImpossible())
continue;
if (p.first.tok->varId() == 0)
continue;
valueFlowForLoopSimplifyAfter(tok, p.first.getExpressionId(), p.second.intvalue, tokenlist, settings);

14
test/testbufferoverrun.cpp
View File

@ -197,6 +197,7 @@ private:
TEST_CASE(array_index_negative5); // #10526
TEST_CASE(array_index_negative6); // #11349
TEST_CASE(array_index_negative7); // #5685
TEST_CASE(array_index_negative8); // #11651
TEST_CASE(array_index_for_decr);
TEST_CASE(array_index_varnames); // FP: struct member #1576, FN: #1586
TEST_CASE(array_index_for_continue); // for,continue
@ -2273,6 +2274,19 @@ private:
ASSERT_EQUALS("[test.cpp:5]: (error) Array 'a[5]' accessed at index -9, which is out of bounds.\n", errout.str());
}
// #11651
void array_index_negative8()
{
check("unsigned g(char*);\n"
"void f() {\n"
" char buf[10];\n"
" unsigned u = g(buf);\n"
" for (int i = u, j = sizeof(i); --i >= 0;)\n"
" char c = buf[i];\n"
"}\n");
ASSERT_EQUALS("", errout.str());
}
void array_index_for_decr() {
check("void f()\n"
"{\n"