Commit Graph

546 Commits

Author SHA1 Message Date
Paul Fultz II b469da1069
Fix issue 8253: False negative: Comparison is always true (early return) (#3043) 2021-01-13 12:35:43 +01:00
Paul Fultz II 678ee00fe9
Infer variables from conditions in valueFlowSubfunction (#3037) 2021-01-11 08:00:13 +01:00
Paul Fultz II a3617fe573
Fix issue 10102: False positive: knownConditionTrueFalse in for loop (#3038) 2021-01-11 07:56:16 +01:00
Paul Fultz II bc3f5554a4
Fix issue 8871: improve check: mismatching container size conditions (#2988) 2021-01-10 13:30:00 +01:00
Paul Fultz II c267d85640
Add generic valueflowBeforeCondition (#3001) 2021-01-08 22:55:04 +01:00
Rikard Falkeborn d19454b935
Refactoring: Convert ValueType to enum class (#3005) 2021-01-02 09:30:00 +01:00
Paul Fultz II bd22070df5
Fix issue 10027: Segmentation fault in ValueFlowAnalyzer::analyze (#2987) 2020-12-26 21:26:39 +01:00
Paul Fultz II a770342593
Fix crash in getInitListSize (#2960) 2020-12-19 12:23:19 +01:00
Daniel Marjamäki 1744cbaf66 astyle formatting
[ci skip]
2020-12-19 08:56:46 +01:00
Paul Fultz II 626dcd0eba
Fix issue 10037: False positive when passing variables to functions by address (#2957) 2020-12-19 08:29:37 +01:00
Paul Fultz II b044f9ba96
Fix issue 9996: false negative: containerOutOfBounds with std::vector::front() and c++11 braced initializer (#2958) 2020-12-18 07:14:11 +01:00
Daniel Marjamäki 75f2ab20e8 Bug hunting; void* => might point at uninitialized data 2020-12-17 07:32:53 +01:00
Paul Fultz II c9d2e55ea9
Fix issue 10035: FP: knownConditionTrueFalse when bool updated in for loop (#2953) 2020-12-16 17:25:21 +01:00
Rikard Falkeborn 324e267559
getSizeOf: Handle long double (#2888) 2020-11-11 22:51:17 +01:00
Daniel Marjamäki 4330a43acb Fixed #9933 (FP: uninitvar when reading to struct) 2020-11-11 22:47:23 +01:00
Paul Fultz II bd7e915c20
Add generic reverse valueflow (#2878) 2020-11-10 16:00:55 +01:00
Paul Fultz II 64638d82bb
Fix issue 9945: FP: containerOutOfBounds (#2845) 2020-10-22 07:41:52 +02:00
Paul Fultz II 047c3ed6ba
Fix issue 9935: FP: knownConditionTrueFalse value flow doesn't account for virtual functions (#2839) 2020-10-09 17:21:27 +02:00
Paul 828a5e2326 Fix issue 9930: valueFlowLifetime hang 2020-10-03 11:01:53 +02:00
Paul Fultz II 857722f859
Fix issue 9711: FP knownConditionTrueFalse for variable modified via pointer (#2813) 2020-09-20 14:27:09 +02:00
Paul Fultz II a42976d656
Fix issue 9898: false positive: knownConditionTrueFalse (#2806) 2020-09-14 18:43:11 +02:00
Paul Fultz II bb7164171c
Fix issue 9894: ValueFlow: wrong known value below while with assignment (#2804)
* Fix issue 9894: ValueFlow: wrong known value below while with assignment
2020-09-14 08:03:25 +02:00
Paul be900873cc FIx issue 9895: ValueFlow: Wrong known value below function call with reference parameter 2020-09-11 16:03:57 -05:00
Daniel Marjamäki 600538a325
Merge pull request #2793 from Ken-Patrick/mixedoperators
Fix false positives with condition with || and &&
2020-09-11 10:11:31 +02:00
Paul 4d1b3e06c7 Fix FPs 2020-09-10 17:06:49 -05:00
Ken-Patrick Lehrmann a114bf0293 Fix false positives with condition with || and &&
The value of something in the middle of a condition with mixed || and &&
gives no information on which branch will be taken.
For instance with:
```
int f(int a, int b, bool x) {\n"
  if (a == 1 && (!(b == 2 && x))) {
  } else {
    if (x) {
    }
  }

  return 0;
}
```
We can enter the if part whether x is true or false, and similarly,
enter the else part whether x is true or false. Same thing with the
value of b.

This fixes the following false positive with above code:
```
:4:13: style: Condition 'x' is always true [knownConditionTrueFalse]
        if (x) {
            ^
:2:33: note: Assuming that condition 'x' is not redundant
    if (a == 6 && (!(b == 21 && x))) {
                                ^

```
2020-09-10 23:27:39 +02:00
Daniel Marjamäki 18e99176e5
Fix issue 9883: endless recursion in getLifetimeTokens (#2786) 2020-09-08 20:14:54 +02:00
Paul Fultz II 5099ca3c8b
Fix issue 9882: segfault in ForwardTraversal (#2785) 2020-09-08 20:14:10 +02:00
Paul d5489fd1f0 Fix issue 9883: endless recursion in getLifetimeTokens 2020-09-08 11:33:29 -05:00
Paul Fultz II ec89c57a90
Fix issue 9849: false positive: containerOutOfBounds (#2753) 2020-08-25 07:12:41 +02:00
Daniel Marjamäki 2bb73840fc astyle formatting 2020-08-23 17:17:33 +02:00
Paul Fultz II ac846b96d1
New check: Iterating a known empty container (#2740) 2020-08-22 09:16:26 +02:00
Paul 71c228a01a Check for containers that modify the size using square bracket 2020-08-10 22:07:22 -05:00
Paul fec2914700 Add tests for container changes 2020-08-09 22:52:03 -05:00
Paul 26693df788 Use forward analyzer for container forward 2020-08-08 00:10:03 -05:00
Ken-Patrick LEHRMANN a923115710 Add missing operators <<= and >>=
This fixes issues (at least false positives) in code using them.
For instance:

```
unsigned compute(unsigned long long a) {
    unsigned num = 0;
    while (a > 0xFFFFFFFF) {
      a >>= 32;
      num += 32;
    }
    if (a > 0xFFFF) {
      a >>= 16;
      num += 16;
    }
    if (a > 0xFF) {
      num += 8;
    }
    return num;
}
```

would give false positive:
```
cppcheck --enable=style  sl3.cpp
Checking sl3.cpp ...
sl3.cpp:11:11: style: Condition 'a>0xFF' is always false [knownConditionTrueFalse]
    if (a > 0xFF) {
          ^
sl3.cpp:3:14: note: Assuming that condition 'a>0xFFFFFFFF' is not redundant
    while (a > 0xFFFFFFFF) {
             ^
sl3.cpp:11:11: note: Condition 'a>0xFF' is always false
    if (a > 0xFF) {
          ^
```
2020-07-23 14:36:34 +02:00
Ken-Patrick Lehrmann 5a3789a23f 9769: Improve value flow for ternary operator
In some cases, the condition of the ternary operator is assigned a known
value after the two possible results, and in such cases, we would not
take the opportunity to assign a value to the ternary operator (and to
the other parents in the ast).
This patch adds this capability.
2020-06-20 10:29:28 +02:00
Daniel Marjamäki 2b0e4926bc valueFlowAfterAssign: variable initialization 2020-06-14 21:14:05 +02:00
Paul Fultz II 0c659a1499
Fix incorrect logic for condition (#2675) 2020-06-09 08:16:53 +02:00
Daniel Marjamäki 6d796b434e Fixed #9731 (ValueFlow: does not handle many assignments well) 2020-06-08 21:17:12 +02:00
Paul Fultz II eed2e829a7
Revert "Cleanup: Removed Tokenizer::simplifyTokenList2. As a side-effect, rules for "simple" token list are now executed on normal token list." (#2666)
This reverts commit 187cde183d.
2020-05-30 11:23:22 +02:00
PKEuS 187cde183d Cleanup: Removed Tokenizer::simplifyTokenList2. As a side-effect, rules for "simple" token list are now executed on normal token list. 2020-05-29 21:21:07 +02:00
Daniel Marjamäki d64631219b Fixed #9741 (Wrong value for sizeof) 2020-05-28 21:24:48 +02:00
Oliver Stöneberg 4f68d85633
optimized non-matchcompiled Token::simpleMatch() a bit (#2640) 2020-05-26 20:13:56 +02:00
Paul Fultz II 526abd4b52
Fix issue 9738: ValueFlow: handle std::tie better (#2657) 2020-05-22 22:57:20 +02:00
Paul Fultz II 8301fa8244
Fix issue 8144: valueFlowBeforeCondition: struct (#2645) 2020-05-21 08:47:48 +02:00
orbitcowboy 9861a5291e Formatted the code, there are no functional changes [ci skip] 2020-05-20 23:45:00 +02:00
PKEuS fb1afe2345 Fixed test suite: Do no longer apply simplifyTokenList2 to token lists, except for those tests that test those simplifications, because checks are no longer run on that simplified token list
Changed failing unit test to TODO tests, as they indicate patterns we do no longer understand properly.
2020-05-20 18:54:16 +02:00
PKEuS c9d8f607df Optimization: Reduced peak memory usage (30% in my test case) by immediately deleting simplecpp::TokenList while creating the cppcheck TokenList. 2020-05-19 12:08:17 +02:00
PKEuS 793ed68029 Refactorization: Moved code from header to source
- from utils.h to new utils.cpp
- from token.h to token.cpp
- from valueflow.h to valueflow.cpp
- from errorlogger.h to errorlogger.cpp
2020-05-19 08:35:12 +02:00
Daniel Marjamäki 08ddd84780 Update copyright year 2020-05-10 11:16:32 +02:00
Daniel Marjamäki 3e0218299b Revert "Update copyright year"
This reverts commit 6eec6c4bd5.
2020-05-10 11:13:05 +02:00
Daniel Marjamäki 6eec6c4bd5 Update copyright year 2020-05-10 11:11:34 +02:00
Paul Fultz II 2a09465a07
Fix issue 9686: Regression: ValueFlow should handle try/catch better (#2618) 2020-04-22 19:20:03 +02:00
Oliver Stöneberg 1af959af2c
fixed -Wextra-semi-stmt Clang warnings (#2553)
* fixed -Wextra-semi-stmt Clang warnings

* adjusted REDIRECT macro to require a semicolon

* testmathlib.cpp: rolled back accidental change
2020-04-21 17:27:51 +02:00
Daniel Marjamäki e8bbfdbfee Fixed #9559 (Multiple checks to std::atomic are not redundant) 2020-04-19 17:29:40 +02:00
Paul Fultz II e2efb338b6
Fix issue 9678: False positive: generic valueflow forward analysis (#2611) 2020-04-19 08:28:07 +02:00
Paul Fultz II 8b27f1c216
Fix issue 9667: crash: crash in valueflow for weird code where label address is returned (#2602) 2020-04-11 13:56:53 +02:00
Paul Fultz II 6cc58e1086
Set a max for the combination of arguments that can be passsed through valueFlowSubFunction (#2579)
* Set a max for the combination of arguments that can be passsed

* Skip mismatch path ids when computing the cross product
2020-04-01 22:33:09 +02:00
Paul Fultz II b68d6f9471
Fix crash in valueflow when using local classes (#2575) 2020-03-22 10:12:53 +01:00
Paul Fultz II 7fd3580f21
Dont traverse conditions multiple times (#2574) 2020-03-20 10:37:16 +01:00
Paul Fultz II f2527f5340
Fix crash in valueFlowForLoopSimplifyAfter (#2573) 2020-03-20 07:16:05 +01:00
Rikard Falkeborn f6e7fb4bd9
Bugfix valuetype for some integer constants (#2545) 2020-02-19 07:51:39 +01:00
Paul Fultz II 921887a281
Use valueFlowGeneric for valueFlowForwardExpression (#2537) 2020-02-16 16:02:22 +01:00
Paul Fultz II 61d847cac2
Fix issue 9637: false positive: Condition 'i<2U' is always true (#2536) 2020-02-15 07:57:43 +01:00
Paul Fultz II 7368a54629
Add generic valueflow forward analysis (#2511) 2020-02-13 16:27:06 +01:00
Daniel Marjamäki 3ec03b8915 Fixed #9571 (False positive: containerSize) 2020-02-12 18:53:36 +01:00
Rikard Falkeborn 0bb98aeef9 Fix 9577 (endless recursion in Valueflow::bifurcate()) (#2492)
Ensure bifurcate() does not recurse endlessly where a variable is
initialized recursively, or a variable is initialized as x(0) or x{0}
followed by a recursive assignment (for example int x(0); x = x / 1;).

The first case is solved by bailing out if there initialization is done
using x(0) or x{0}, the second by adding a missing depth argument to a
recursive call.
2020-01-17 03:17:26 +01:00
Paul Fultz II 90f82d0374 Fix issue 9541: false negative: knownConditionTrueFalse (#2473)
* Fix issue 9541: false negative: knownConditionTrueFalse

* Add another test case

* Add another test

* Fix FPs

* Format

* Fix compile error

* Remove double conditions

* Fix compile error
2020-01-05 16:25:33 +01:00
Paul Fultz II 75de485c4d Fix issue 9551: Out-of-bounds in getLifetimeTokens() (#2461) 2019-12-29 08:23:58 +01:00
Daniel Marjamäki fe23d017f3 Fixed #8419 (False positive accessMoved on int) 2019-12-21 07:39:14 +01:00
Daniel Marjamäki 33ec78fe6e Fixed #9036 (false positive: (style) Condition 's.x<127U' is always true) 2019-12-20 19:06:35 +01:00
Daniel Marjamäki a241be0ecc Fixed #9434 (False positive: Out of bounds access when using const pointer) 2019-12-15 20:10:28 +01:00
Daniel Marjamäki bcfc5924fa Fixed #9532 (False positive: Out of bounds access in expression 'v[0]' because 'v' is empty.) 2019-12-14 19:04:19 +01:00
Sebastian 95e0b0d0f9
Fix #9510: Crash in valueflow.cpp solveExprValues() (division by zero) (#2420)
`break` if divider `intval` is 0 to avoid division by 0 as suggested by @pfultz2
Trac ticket: https://trac.cppcheck.net/ticket/9510
2019-12-06 08:08:40 +01:00
Paul Fultz II f9d33c07f8 Fix issue 9458: Crash with shadow variables in a lambda (#2406)
* Fix issue 9458: Crash with shadow variables in a lambda

* Format
2019-11-29 09:45:02 +01:00
Rikard Falkeborn 11319a397a ValueFlow: Add test with hexadecimal floating point literal (#2342) 2019-11-10 08:27:55 +01:00
Rikard Falkeborn f83eb127ae ValueFlow: sizeof string and char literals (#2285) 2019-10-20 21:02:28 +02:00
Daniel Marjamäki e50b9e2bef Fixed #8784 (False positive uninitialized variable) 2019-10-20 15:20:05 +02:00
Daniel Marjamäki 9a2b71494f ValueFlow: Set value for :: 2019-10-19 21:08:59 +02:00
Daniel Marjamäki e0093c99ce Fixed #9276 (False positive: ValueFlow does not handle return in switch properly.) 2019-10-18 16:16:56 +02:00
Daniel Marjamäki 3a0a0fdefb Fixed #9424 (False positive: known condition after function call) 2019-10-18 08:21:07 +02:00
Ken-Patrick Lehrmann 24211cf8b9 Fix crashes in valueflow (#2236)
* Fix crashes in valueflow

http://cppcheck1.osuosl.org:8000/crash.html

For instance in http://cppcheck1.osuosl.org:8000/styx
```
==19651==ERROR: AddressSanitizer: SEGV on unknown address 0x00000000001c (pc 0x556f21abc3df bp 0x7ffc140d2720 sp 0x7ffc140d2710 T0)
==19651==The signal is caused by a READ memory access.
==19651==Hint: address points to the zero page.
    #0 0x556f21abc3de in Variable::isGlobal() const ../lib/symboldatabase.h:342
    #1 0x556f221f801a in valueFlowForwardVariable ../lib/valueflow.cpp:2471
    #2 0x556f22208130 in valueFlowForward ../lib/valueflow.cpp:3204
    #3 0x556f221e9e14 in valueFlowReverse ../lib/valueflow.cpp:1892
    #4 0x556f221f1a43 in valueFlowBeforeCondition ../lib/valueflow.cpp:2200
    #5 0x556f2223dbb5 in ValueFlow::setValues(TokenList*, SymbolDatabase*, ErrorLogger*, Settings const*) ../lib/valueflow.cpp:6521
    #6 0x556f220e5991 in Tokenizer::simplifyTokens1(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) ../lib/tokenize.cpp:2342
    #7 0x556f21d8d066 in CppCheck::checkFile(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::istream&) ../lib/cppcheck.cpp:508
    #8 0x556f21d84cd3 in CppCheck::check(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) ../lib/cppcheck.cpp:192
    #9 0x556f21a28796 in CppCheckExecutor::check_internal(CppCheck&, int, char const* const*) ../cli/cppcheckexecutor.cpp:884
    #10 0x556f21a24be8 in CppCheckExecutor::check(int, char const* const*) ../cli/cppcheckexecutor.cpp:198
    #11 0x556f22313063 in main ../cli/main.cpp:95
```

* Add test case for crash in valueflow
2019-10-16 20:54:07 +02:00
Daniel Marjamäki 887825d834 astyle formatting
[ci skip]
2019-10-05 15:42:47 +02:00
Paul Fultz II 997803869d Forward values after assignment in valueFlowReverse (#2226)
* Forward values after assignment in valueFlowReverse

* Rename variables

* Format
2019-10-03 09:58:57 +02:00
Daniel Marjamäki b55c587ab2 astyle formatting
[ci skip]
2019-09-26 10:32:49 +02:00
Paul Fultz II 597d0fa35b Support expression in valueFlowAfterCondition (#2219)
* Add valueFlowForwardExpression function to forward values of an expression

* Use token for expression

* Fix name in bailout message

* Handle expressions

* Add more tests for more expressions

* Add more tests

* Solve the expression if possible

* Formatting
2019-09-26 10:32:25 +02:00
Daniel Marjamäki 049f6475ee astyle formatting
[ci skip]
2019-09-20 15:07:27 +02:00
Paul Fultz II ad8abdb0c3 Add impossible values to ValueFlow (#2186)
* Add impossible category

* Replace values

* Try to adjust known values

* Add ! for impossible values

* Add impossible with possible values

* Remove contradictions

* Add values when the branch is not dead

* Only copy possible values

* Dont bail on while loops

* Load std lib in valueflow

* Check for function calls

* Fix stl errors

* Fix incorrect impossible check

* Fix heap-after-use error

* Remove impossible values when they are lowered

* Show the bound and remove overlaps

* Infer conditions

* Dont push pointer values through dynamic_cast

* Add test for dynamic_cast issue

* Add shifttoomanybits test

* Add test for div by zero

* Add a test for issue 9315

* Dont make impossible value inconclusive

* Fix FP with shift operator

* Improve handleKnownValuesInLoop for impossible values

* Fix cppcheck warning

* Fix impossible values for ctu

* Bailout for streams

* Check equality conditions

* Fix overflows

* Add regression test for 9332

* Remove duplicate conditions

* Skip impossible values for invalid value

* Check for null

* Rename bound to range

* Formatting
2019-09-20 15:06:37 +02:00
Paul Fultz II 27ebff7ae4 Add deeper analysis of when a function changes a containers size (#2149)
* Add deeper analysis of when a function changes a containers size

* Fix issues

* Track addressOf
2019-09-06 21:18:45 +02:00
Paul Fultz II 3aef0c9bd3 Fix issue 8715: regression uninitvar not detected (#2092) 2019-08-16 07:48:54 +02:00
Paul Fultz II 68e8253920 Fix issue 8313 and 7326: Track values of pointer aliases in valueflow 2019-08-12 12:58:53 +02:00
Paul Fultz II 9aa97cbb95 Fix issue 8296: ValueFlow: value not set in conditional scope in subfunction (#2071)
* Fix issue 8296: ValueFlow: value not set in conditional scope in subfunction

* Refactor condition checkingg

* Make test case TODO
2019-08-11 15:39:37 +02:00
Paul Fultz II bd02ca5ccb Fix issue 9207: Not detected 'always true' and unreachable code 2019-08-08 07:46:47 +02:00
Paul Fultz II aaeec462e6 Re-enable valueFlowSubFunction (#2063)
* Re-enable valueFlowSubFunction

* Formatting

* Skip ternary operators in subfunctions

* Fix test with iostreams

* Fix FP with multiple parameters
2019-08-05 16:26:32 +02:00
Paul Fultz II ffdd2dc793 Fix issue 8924: Re-enable valueFlowTerminatingCondition 2019-08-05 07:18:06 +02:00
Daniel Marjamäki ce53931d00 Fixed #9251 (False positive: unininitialized variable (multi variables)) 2019-08-03 21:12:34 +02:00
Daniel Marjamäki 607b3daca8 ValueFlow: Improve bailout for structs etc in loops 2019-07-29 15:51:48 +02:00
Daniel Marjamäki e8ec6e6f11 Fixed #8349 (Noisy nullPointerRedundantCheck) 2019-07-27 20:03:06 +02:00
Daniel Marjamäki bbcffce529 Fixed #9062 (False positive "condition is always true") 2019-07-24 19:16:35 +02:00