Commit Graph

584 Commits

Author SHA1 Message Date
Daniel Marjamäki 5563fef7bb Fixed #9008 (new crash in clang test suite) 2019-02-28 20:34:07 +01:00
Daniel Marjamäki 857681a049 Make quick fix for uninitialized variable false positive. Will look more at this soon. 2019-02-28 09:52:52 +01:00
rikardfalkeborn c9efc26578 valueflow: Mark getLifetimeToken() static (#1703)
Fixes a compiler warning about missing declaration.
2019-02-26 23:35:11 +01:00
Paul Fultz II fd3c1fd040 Fix issue 1777: Undefined Behavior: Comparing pointers to different objects
This uses the lifetime analysis to check when comparing pointer that point to different objects:

```cpp
int main(void)
{
    int foo[10];
    int bar[10];
    int diff;

    if(foo > bar)   // Undefined Behavior
    {
       diff = 1;
    }

    return 0;
}
```
2019-02-23 08:32:08 +01:00
Paul Fultz II 507c7a4388 Improvement to lifetime tracking of addressof and derefencing
This will now warn for cases like this:

```cpp
auto& f() {
    std::vector<int> x;
    return x[0];
}
```

It also improves the handling of address of operator, so it can now warn across some function calls, like this:

```cpp
int& f(int& a) {
    return a;
}
int* hello() {
    int x = 0;
    return &f(x);
}
```
2019-02-22 06:38:56 +01:00
Paul Fultz II 715714f4de Forward lifetimes in "for" loops (#1682)
* Forward lifetimes in for loops

* Format
2019-02-22 06:37:02 +01:00
Daniel Marjamäki 9337af8965 astyle formatting 2019-02-09 08:48:10 +01:00
Paul Fultz II 797eccc203 Fix possible out of bounds access on arguments (#1652)
* Fix possible outbounds access on arguments

* Log a warning when the arguments mismatch

* Format
2019-02-09 08:47:36 +01:00
Daniel Marjamäki bd7790fd8c Update copyright year 2019-02-09 07:24:06 +01:00
Paul Fultz II c176775afb Avoid infinite recursion in getLifetimeVariable (#1634)
* Fix direct recursion

* Limit depth of getLifetimeVariable
2019-01-31 10:34:41 +01:00
Paul Fultz II 165a22ed0f Lifetime: Support analysis with functions that do not return a reference (#1632)
* Initial support for function return

* Add test case

* Add support for reference parameters

* Format
2019-01-29 09:47:52 +01:00
Paul Fultz II d6aaf401df Lifetime: Follow functions that return references
This will now warn for cases like this:

```cpp
int& f(int& a) {
    return a;
}
int& hello() {
    int x = 0;
    return f(x);
}
```
2019-01-26 11:03:57 +01:00
Paul Fultz II 3975913637 Extend lifetime checking for references
This will use the lifetime checker for dangling references. It will find these cases for indirectly assigned reference:

```cpp
int &foo()
{
    int s = 0;
    int& x = s;
    return x;
}
```

This will also fix issue 510 as well:

```cpp
int &f( int k )
{
    static int &r = k;
    return r;
}
```
2019-01-23 07:29:16 +01:00
Paul Fultz II 4b37f276c2 ValueFlow: Set arrays to true when converting to a boolean
This sets it by checking the parent. It doesn't handle function parameters yet.
2019-01-21 20:05:35 +01:00
Paul Fultz II 5fa956a597 Fix issue 8932: False positive knownConditionTrueFalse - valueflow ignores operator < (#1584) 2019-01-11 08:39:23 +01:00
practicalswift 0a1b3a9d6f Fix typos (#1568) 2019-01-06 17:15:57 +01:00
Daniel Marjamäki 5636497c0b Fixed #8863 (false positive: (warning) Accessing an item in container 's'. Either the condition 's.empty()' is redundant or 's' can be empty.) 2019-01-06 12:21:55 +01:00
Paul Fultz II bba6dfb8b2 Fix issue 4744: ValueFlow: known integer result
This fixes valueflow to have a value for `||` operator here:

```cpp
bool f()
{
	bool a = (4 == 3); // <-- 0
	bool b = (3 == 3); // <-- 1
	return a || b; // <-- 1
}
```
2019-01-03 07:05:31 +01:00
Daniel Marjamäki 2b63997c2c Fixed #8928 (false positive: (style) Variable 'x' is assigned a value that is never used.) 2019-01-02 20:23:02 +01:00
Daniel Marjamäki 39ceb53578 Comment out code in valueFlowArray. There was too many false positives. 2019-01-02 19:57:11 +01:00
Daniel Marjamäki 39a96a5a16 ValueFlow: Temporarily comment out valueFlowTerminatingCondition 2019-01-02 19:42:08 +01:00
Daniel Marjamäki 115be7dfc8 ValueFlow: better FwdAnalysis for complex expressions 2019-01-01 18:23:47 +01:00
Daniel Marjamäki be7afac875 ValueFlow: remove handling of == for complex expressions it did not work properly 2019-01-01 17:23:46 +01:00
Daniel Marjamäki 20436ea986 Fix compiler warning 2019-01-01 17:04:47 +01:00
rikardfalkeborn 13ffefc8b8 Valueflow: Fix right shift with more than 31 bits (#1553)
When comparing if the shift is large enough to make the result zero, use
an unsigned long long to make sure the result fits. Also, a check that
avoids setting the value if the shift is equal to or larger than the
number of bits in the operand (this is undefined behaviour). Finally,
add a check to make sure the calculated value is not too large to store.

Add test cases to cover this.

This was detected by an MSVC warning.

valueflow.cpp(1350): warning C4334: '<<' : result of 32-bit shift implicitly
                     converted to 64 bits (was 64-bit shift intended?)
2019-01-01 14:15:50 +01:00
Daniel Marjamäki ed514644b8 Renamed FwdAnalysisAllPaths to FwdAnalysis 2018-12-31 18:00:47 +01:00
Daniel Marjamäki 4918a18bfb ValueFlow: Value of expression after condition 2018-12-31 17:37:38 +01:00
Daniel Marjamäki 141ce7cd63 ValueFlow: Use FwdAnalysisAllPaths in ValueFlow to track complex expressions 2018-12-31 17:05:46 +01:00
Carlo Marcelo Arenas Belón 5ae6861a0f clang warnings (#1547)
* valueflow: remove unused variable known

since e4677ae640 will trigger :

lib/valueflow.cpp:506:20: warning: unused variable 'known' [-Wunused-variable]
        const bool known = (parent->astOperand1()->hasKnownValue() ||

* templatesimplifier: cleanup

since 48c960f56c showing:

lib/templatesimplifier.h:279:16: warning: private field 'mTokenizer' is not used
      [-Wunused-private-field]
    Tokenizer *mTokenizer;
2018-12-30 11:32:48 +01:00
Paul Fultz II e4677ae640 Fix issue 8910: Regression: ValueFlow: wrong conditional tokvalue
This fixes issue in:

```cpp
void f()
{
    char stack[512];
    RGNDATA *data;

    if (data_size > sizeof (stack))
        data = malloc (data_size);
    else
        data = (RGNDATA *)stack;

    if ((char *)data != stack)
            free (data); // <- data is not stack
}
```

It seems the `ProgramMemory` can't handle two known values(such as int and tok) together. So instead `ValueFlowAfterAssign` runs `ValueFlowForward` with tok values and then runs it with the other values.
2018-12-29 09:31:21 +01:00
rikardfalkeborn 036fcf7827 Fix warnings (#1541)
* Fix reorder warning

* Fix override warnings

Clang warns about missing overrides.

* Remove unused function

* Add missing argument to function calls
2018-12-28 12:59:05 +01:00
Daniel Marjamäki a40fe3c67f Fixed #7872 (ValueFlow: static_cast) 2018-12-27 21:33:01 +01:00
Daniel Marjamäki bc34f0239d Disable the subfunction value flow analysis. It does not work well and needs to be rewritten. There are false positives. 2018-12-18 14:36:49 +01:00
Paul Fultz II 34330b51d1 Fix issue 8905: Condition 'a==0' is always false
This fixes the FP in:

```cpp
void f(const int a[]){ if (a == 0){} }
```
2018-12-18 08:16:43 +01:00
Paul Fultz II 025881cf35 Fix issue 8829: Condition '...' is always true (int buf[42]; if(buf != NULL){})
This makes arrays non-null in valueflow, so it can catch comparisons against null that is always true:

```cpp
void f(void) {
   int buf[42];
   if( buf != 0) {;} // << always true
}
```
2018-12-17 06:07:34 +01:00
Paul Fultz II 3262a3bebe Add isSameExpression to valueflow analysis
Check for same expressions in valueflow analysis.
2018-12-16 07:35:27 +01:00
Paul Fultz II 45dcfad9f9 Fix issue 8899: False positive returnDanglingLifetime when returning by value
This fixes the FP from:

```cpp
#include <string>

class MyString
{
        public:
        MyString(char* source)
        {
                length = strlen( source );
                buffer = new char[length+1];
                if( buffer )
                {
                        strcpy( buffer, source );
                }
        }

        char* buffer;
        int length;
};

MyString Foo()
{
        char arr[20];
        sprintf(arr, "hello world");

        return arr;
}

void main()
{
        MyString str = Foo();

        printf(str.buffer);
}
```
2018-12-15 17:58:45 +01:00
Daniel Marjamäki 88c61e8d1e ValueFlow: Avoid FP when lambda is used 2018-12-04 18:54:26 +01:00
Daniel Marjamäki f5a94ed300 ValueFlow: Fix FP when lambda is called 2018-12-04 18:46:00 +01:00
Igor 61878c5e11 Add null pointer check to fix SEGFAULT (#1499)
* Add null pointer check to fix segfault

* Add first test case to reproduce problem
2018-12-02 14:36:01 +01:00
Paul Fultz II 3e1b34dd8f Fix FPs and crashes with byDerefCopy (#1503)
* Fix FP when inserting a range into a container

* Formatting

* Fix crash
2018-12-02 14:31:31 +01:00
Paul Fultz II b841b818d2 Fix 8872: Crash in LifetimeStore when there is no scope for variable
This fixes crash in:

```cpp
struct edit_line_paste_over {
    void operator()(agi::Context *c) override {
        paste_lines(c, true, [&](AssDialogue *new_line) -> AssDialogue * {
            AssDialogue *ret = paste_over(c->parent, pasteOverOptions, new_line, static_cast<AssDialogue*>(&*pos));
            return ret;
          });
    }
};
```
2018-12-01 19:11:26 +01:00
Paul Fultz II 67dd822910 Fix FP in lifetime anlaysis: Dont decay std array
This will fix FP with:

```cpp
std::array<char, 1> f() {
    std::array<char, 1> x;
    return x;
}
```
2018-12-01 19:09:19 +01:00
Daniel Marjamäki 0ad757fc78 valueFlowLifetime: Try to cleanup the loop a little. No functional change is intended. 2018-11-27 06:43:59 +01:00
Paul Fultz II 5a6f9ac82a Fix FP with strcmp and terminating conditions 2018-11-27 06:39:29 +01:00
Daniel Marjamäki 2887ee10c0 Fixed #8800 (Possible variable assignment ignored in boolean expression) 2018-11-26 14:00:03 +01:00
Paul Fultz II a3921ea861 Refactor valueFlowAfterCondition
So this unifies the `valueFlowAfterCondition` so it re-uses more code between checking for integers and container sizes. This should make valueFlowContainer more robust.

It also extends valueflow to support container comparisons such as `if (v.size() < 3)` or `if (v.size() > 3)` using the same mechanism that is used for integers.
2018-11-24 10:07:12 +01:00
Daniel Marjamäki 52f9650533 Refactoring: Use visitAstNodes 2018-11-23 19:16:19 +01:00
Daniel Marjamäki 745b58de26 Refactoring: Use visitAstNodes 2018-11-23 17:18:07 +01:00
Paul Fultz II f16d9d7d90 Issue 6175: Check lifetime of a variables stored in containers and member variables
Cppcheck will now warn for all cases here:

```cpp
#include <vector>
class CCluster {};
class MyClass
{ public:
    std::vector<CCluster*> m_cluster;
    void createCluster()
    {
        CCluster cl;
        CCluster* pcl=&cl;
        m_cluster.push_back(pcl);
    }
    void createCluster2()
    {
        CCluster cl;
        m_cluster.push_back(&cl);
    }
    CCluster* Cluster()
    {
        CCluster cl;
        CCluster* pcl=&cl;
        return pcl;
    }
    CCluster* Cluster2()
    {
        CCluster cl;
        return &cl;
    }
};

```
2018-11-21 08:43:57 +01:00