Fix #12833 FP knownConditionTrueFalse regression (cppcheck-opensource#6514)

mptre · web-flow · commit 5ef9ba039885 · 2024-06-12T13:21:58.000+02:00
Performing arithmetic on two pointers is not guaranteed to always yield a non-zero value. Introduced in commit ac0bd6d ("Fix 12760: FN knownConditionTrueFalse for pointer + offset (cppcheck-opensource#6491)").
diff --git a/lib/vf_settokenvalue.cpp b/lib/vf_settokenvalue.cpp
@@ -442,8 +442,9 @@ namespace ValueFlow
         }
 
         // Offset of non null pointer is not null also
-        else if (astIsPointer(tok) && Token::Match(parent, "+|-") && value.isIntValue() && value.isImpossible() &&
-                 value.intvalue == 0) {
+        else if (astIsPointer(tok) && Token::Match(parent, "+|-") &&
+                 (parent->astOperand2() == nullptr || !astIsPointer(parent->astOperand2())) &&
+                 value.isIntValue() && value.isImpossible() && value.intvalue == 0) {
             setTokenValue(parent, value, settings);
         }
 
diff --git a/test/testcondition.cpp b/test/testcondition.cpp
@@ -4620,6 +4620,17 @@ class TestCondition : public TestFixture {
               "    if (j != 0) {}\n"
               "}\n");
         ASSERT_EQUALS("", errout_str());
+
+        check("void f() {\n"
+              "    const char *s1 = foo();\n"
+              "    const char *s2 = bar();\n"
+              "    if (s2 == NULL)\n"
+              "        return;\n"
+              "    size_t len = s2 - s1;\n"
+              "    if (len == 0)\n"
+              "        return;\n"
+              "}\n");
+        ASSERT_EQUALS("", errout_str());
     }
 
     void alwaysTrueSymbolic()

Original file line number	Diff line number	Diff line change
`@@ -442,8 +442,9 @@ namespace ValueFlow`
`442`	`442`	`}`
`443`	`443`
`444`	`444`	`// Offset of non null pointer is not null also`
`445`		`- else if (astIsPointer(tok) && Token::Match(parent, "+\|-") && value.isIntValue() && value.isImpossible() &&`
`446`		`- value.intvalue == 0) {`
	`445`	`+ else if (astIsPointer(tok) && Token::Match(parent, "+\|-") &&`
	`446`	`+ (parent->astOperand2() == nullptr \|\| !astIsPointer(parent->astOperand2())) &&`
	`447`	`+ value.isIntValue() && value.isImpossible() && value.intvalue == 0) {`
`447`	`448`	`setTokenValue(parent, value, settings);`
`448`	`449`	`}`
`449`	`450`