Fixed danmar#5840 (False positive (inconclusive): Possible nullpointer dereference - use before for-loop over nested list)

danmar · danmar · commit 5490fad8c763 · 2014-12-14T14:10:42.000+01:00
diff --git a/lib/valueflow.cpp b/lib/valueflow.cpp
@@ -468,6 +468,16 @@ static void valueFlowBeforeCondition(TokenList *tokenlist, ErrorLogger *errorLog
             if (tok2->astParent() || tok2->str() != "(" || !Token::simpleMatch(tok2->link(), ") {"))
                 continue;
 
+            // Variable changed in 3rd for-expression
+            if (Token::simpleMatch(tok2->previous(), "for (")) {
+                if (isVariableChanged(tok2->astOperand2()->astOperand2(), tok2->link(), varid)) {
+                    varid = 0U;
+                    if (settings->debugwarnings)
+                        bailout(tokenlist, errorLogger, tok, "variable " + var->name() + " used in loop");
+                }
+            }
+
+            // Variable changed in loop code
             if (Token::Match(tok2->previous(), "for|while (")) {
                 const Token * const start = tok2->link()->next();
                 const Token * const end   = start->link();
diff --git a/test/testvalueflow.cpp b/test/testvalueflow.cpp
@@ -403,6 +403,12 @@ class TestValueFlow : public TestFixture {
                "}";
         ASSERT_EQUALS(false, testValueOfX(code, 2U, 37));
 
+        code = "void f(int x) {\n"
+               "  a = x;\n"
+               "  for (; x!=1; x++) { }\n"
+               "}";
+        ASSERT_EQUALS(false, testValueOfX(code, 2U, 1));
+
         code = "void f(menu *x) {\n"
                "  a = x->parent;\n"
                "  for (i=0;(i<10) && (x!=0); i++) { x = x->next; }\n"
