From f96e3c9d84fdda78c9fa816e2b53868bf67d2921 Mon Sep 17 00:00:00 2001
From: chrchr-github <78114321+chrchr-github@users.noreply.github.com>
Date: Tue, 20 Jun 2023 18:06:57 +0200
Subject: [PATCH] Fix #11766 FP uninitdata with cast (#5170)

---
 lib/checkuninitvar.cpp | 11 +++++++++--
 test/testuninitvar.cpp | 14 ++++++++++++++
 2 files changed, 23 insertions(+), 2 deletions(-)

diff --git a/lib/checkuninitvar.cpp b/lib/checkuninitvar.cpp
index 6ffb0e4a8..c2b4dc4f2 100644
--- a/lib/checkuninitvar.cpp
+++ b/lib/checkuninitvar.cpp
@@ -1250,8 +1250,15 @@ const Token* CheckUninitVar::isVariableUsage(bool cpp, const Token *vartok, cons
                 tok = tok->astParent();
         }
         if (Token::simpleMatch(tok->astParent(), "=")) {
-            if (astIsLhs(tok) && (alloc == ARRAY || !derefValue || !derefValue->astOperand1() || !derefValue->astOperand1()->isCast()))
-                return nullptr;
+            if (astIsLhs(tok)) {
+                if (alloc == ARRAY || !derefValue || !derefValue->isUnaryOp("*"))
+                    return nullptr;
+                const Token* deref = derefValue->astOperand1();
+                while (deref && deref->isCast())
+                    deref = deref->astOperand1();
+                if (deref == vartok)
+                    return nullptr;
+            }
             if (alloc != NO_ALLOC && astIsRhs(valueExpr))
                 return nullptr;
         }
diff --git a/test/testuninitvar.cpp b/test/testuninitvar.cpp
index 1dc1e647f..fd0ffea2c 100644
--- a/test/testuninitvar.cpp
+++ b/test/testuninitvar.cpp
@@ -2066,6 +2066,20 @@ private:
                        "    return i;\n"
                        "}\n");
         ASSERT_EQUALS("[test.cpp:4]: (error) Memory is allocated but not initialized: a\n", errout.str());
+
+        checkUninitVar("void* f(size_t n, int i) {\n" // #11766
+                       "    char* p = (char*)malloc(n);\n"
+                       "    *(int*)p = i;\n"
+                       "    return p;\n"
+                       "}\n");
+        ASSERT_EQUALS("", errout.str());
+
+        checkUninitVar("void* f(size_t n, int i) {\n"
+                       "    char* p = (char*)malloc(n);\n"
+                       "    *(int*)(void*)p = i;\n"
+                       "    return p;\n"
+                       "}\n");
+        ASSERT_EQUALS("", errout.str());
     }
 
     // class / struct..