/*

* Cppcheck - A tool for static C/C++ code analysis

* Copyright (C) 2007-2020 Cppcheck team.

*

* This program is free software: you can redistribute it and/or modify

* it under the terms of the GNU General Public License as published by

* the Free Software Foundation, either version 3 of the License, or

* (at your option) any later version.

*

* This program is distributed in the hope that it will be useful,

* but WITHOUT ANY WARRANTY; without even the implied warranty of

* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

* GNU General Public License for more details.

*

* You should have received a copy of the GNU General Public License

* along with this program. If not, see <http://www.gnu.org/licenses/>.

*/

#include "check.h"

#include "checknullpointer.h"

#include "config.h"

#include "ctu.h"

#include "library.h"

#include "settings.h"

#include "testsuite.h"

#include "token.h"

#include "tokenize.h"

#include <simplecpp.h>

#include <list>

#include <map>

#include <string>

#include <vector>

class TestNullPointer : public TestFixture {

public:

TestNullPointer() : TestFixture("TestNullPointer") {

}

private:

Settings settings;

void run() OVERRIDE {

LOAD_LIB_2(settings.library, "std.cfg");

settings.addEnabled("warning");

TEST_CASE(nullpointerAfterLoop);

TEST_CASE(nullpointer1);

TEST_CASE(nullpointer2);

TEST_CASE(structDerefAndCheck); // dereferencing struct and then checking if it's null

TEST_CASE(pointerDerefAndCheck);

TEST_CASE(nullpointer5); // References should not be checked

TEST_CASE(nullpointerExecutionPaths);

TEST_CASE(nullpointerExecutionPathsLoop);

TEST_CASE(nullpointer7);

TEST_CASE(nullpointer9);

TEST_CASE(nullpointer10);

TEST_CASE(nullpointer11); // ticket #2812

TEST_CASE(nullpointer12); // ticket #2470

TEST_CASE(nullpointer15); // #3560 (fp: return p ? f(*p) : f(0))

TEST_CASE(nullpointer16); // #3591

TEST_CASE(nullpointer17); // #3567

TEST_CASE(nullpointer18); // #1927

TEST_CASE(nullpointer19); // #3811

TEST_CASE(nullpointer20); // #3807 (fp: return p ? (p->x() || p->y()) : z)

TEST_CASE(nullpointer21); // #4038 (fp: if (x) p=q; else return;)

TEST_CASE(nullpointer23); // #4665 (false positive)

TEST_CASE(nullpointer24); // #5082 fp: chained assignment

TEST_CASE(nullpointer25); // #5061

TEST_CASE(nullpointer26); // #3589

TEST_CASE(nullpointer27); // #6568

TEST_CASE(nullpointer28); // #6491

TEST_CASE(nullpointer30); // #6392

TEST_CASE(nullpointer31); // #8482

TEST_CASE(nullpointer32); // #8460

TEST_CASE(nullpointer33);

TEST_CASE(nullpointer34);

TEST_CASE(nullpointer35);

TEST_CASE(nullpointer36); // #9264

TEST_CASE(nullpointer37); // #9315

TEST_CASE(nullpointer38);

TEST_CASE(nullpointer39); // #2153

TEST_CASE(nullpointer40);

TEST_CASE(nullpointer41);

TEST_CASE(nullpointer42);

TEST_CASE(nullpointer43); // #9404

TEST_CASE(nullpointer44); // #9395, #9423

TEST_CASE(nullpointer45);

TEST_CASE(nullpointer46); // #9441

TEST_CASE(nullpointer47); // #6850

TEST_CASE(nullpointer48); // #9196

TEST_CASE(nullpointer49); // #7804

TEST_CASE(nullpointer50); // #6462

TEST_CASE(nullpointer51);

TEST_CASE(nullpointer52);

TEST_CASE(nullpointer53); // #8005

TEST_CASE(nullpointer54); // #9573

TEST_CASE(nullpointer55); // #8144

TEST_CASE(nullpointer56); // #9701

TEST_CASE(nullpointer57); // #9751

TEST_CASE(nullpointer58); // #9807

TEST_CASE(nullpointer59); // #9897

TEST_CASE(nullpointer60); // #9842

TEST_CASE(nullpointer_addressOf); // address of

TEST_CASE(nullpointerSwitch); // #2626

TEST_CASE(nullpointer_cast); // #4692

TEST_CASE(nullpointer_castToVoid); // #3771

TEST_CASE(nullpointer_subfunction);

TEST_CASE(pointerCheckAndDeRef); // check if pointer is null and then dereference it

TEST_CASE(nullConstantDereference); // Dereference NULL constant

TEST_CASE(gcc_statement_expression); // Don't crash

TEST_CASE(snprintf_with_zero_size);

TEST_CASE(snprintf_with_non_zero_size);

TEST_CASE(printf_with_invalid_va_argument);

TEST_CASE(scanf_with_invalid_va_argument);

TEST_CASE(nullpointer_in_return);

TEST_CASE(nullpointer_in_typeid);

TEST_CASE(nullpointer_in_for_loop);

TEST_CASE(nullpointerDelete);

TEST_CASE(nullpointerSubFunction);

TEST_CASE(nullpointerExit);

TEST_CASE(nullpointerStdString);

TEST_CASE(nullpointerStdStream);

TEST_CASE(nullpointerSmartPointer);

TEST_CASE(functioncall);

TEST_CASE(functioncalllibrary); // use Library to parse function call

TEST_CASE(functioncallDefaultArguments);

TEST_CASE(nullpointer_internal_error); // #5080

TEST_CASE(ticket6505);

TEST_CASE(subtract);

TEST_CASE(addNull);

TEST_CASE(isPointerDeRefFunctionDecl);

TEST_CASE(ctu);

}

void check(const char code[], bool inconclusive = false, const char filename[] = "test.cpp") {

// Clear the error buffer..

errout.str("");

settings.inconclusive = inconclusive;

// Tokenize..

Tokenizer tokenizer(&settings, this);

std::istringstream istr(code);

if (!tokenizer.tokenize(istr, filename))

return;

// Check for null pointer dereferences..

CheckNullPointer checkNullPointer;

checkNullPointer.runChecks(&tokenizer, &settings, this);

}

void checkP(const char code[]) {

// Clear the error buffer..

errout.str("");

settings.inconclusive = false;

// Raw tokens..

std::vector<std::string> files(1, "test.cpp");

std::istringstream istr(code);

const simplecpp::TokenList tokens1(istr, files, files[0]);

// Preprocess..

simplecpp::TokenList tokens2(files);

std::map<std::string, simplecpp::TokenList*> filedata;

simplecpp::preprocess(tokens2, tokens1, files, filedata, simplecpp::DUI());

// Tokenizer..

Tokenizer tokenizer(&settings, this);

tokenizer.createTokens(std::move(tokens2));

tokenizer.simplifyTokens1("");

// Check for null pointer dereferences..

CheckNullPointer checkNullPointer;

checkNullPointer.runChecks(&tokenizer, &settings, this);

}

void nullpointerAfterLoop() {

check("int foo(const Token *tok)\n"

"{\n"

" while (tok);\n"

" tok = tok->next();\n"

"}", true);

ASSERT_EQUALS("[test.cpp:3] -> [test.cpp:4]: (warning) Either the condition 'tok' is redundant or there is possible null pointer dereference: tok.\n", errout.str());

// #2681

{

const char code[] = "void foo(const Token *tok)\n"

"{\n"

" while (tok && tok->str() == \"=\")\n"

" tok = tok->next();\n"

"\n"

" if (tok->str() != \";\")\n"

" ;\n"

"}\n";

check(code);

ASSERT_EQUALS("[test.cpp:3] -> [test.cpp:6]: (warning) Either the condition 'tok' is redundant or there is possible null pointer dereference: tok.\n", errout.str());

}

check("void foo()\n"

"{\n"

" for (const Token *tok = tokens; tok; tok = tok->next())\n"

" {\n"

" while (tok && tok->str() != \";\")\n"

" tok = tok->next();\n"

" }\n"

"}");

TODO_ASSERT_EQUALS("[test.cpp:5] -> [test.cpp:3]: (warning) Either the condition 'while' is redundant or there is possible null pointer dereference: tok.\n", "", errout.str());

check("void foo(Token &tok)\n"

"{\n"

" for (int i = 0; i < tok.size(); i++ )\n"

" {\n"

" while (!tok)\n"

" char c = tok.read();\n"

" }\n"

"}");

ASSERT_EQUALS("", errout.str());

check("void foo()\n"

"{\n"

" for (const Token *tok = tokens; tok; tok = tok->next())\n"

" {\n"

" while (tok && tok->str() != \";\")\n"

" tok = tok->next();\n"

" if( !tok ) break;\n"

" }\n"

"}");

ASSERT_EQUALS("", errout.str());

check("void foo()\n"

"{\n"

" for (const Token *tok = tokens; tok; tok = tok ? tok->next() : NULL)\n"

" {\n"

" while (tok && tok->str() != \";\")\n"

" tok = tok->next();\n"

" }\n"

"}");

ASSERT_EQUALS("", errout.str());

check("void foo(A*a)\n"

"{\n"

" switch (a->b()) {\n"

" case 1:\n"

" while( a ){\n"

" a = a->next;\n"

" }\n"

" break;\n"

" case 2:\n"

" a->b();\n"

" break;\n"

" }\n"

"}");

ASSERT_EQUALS("", errout.str());

// dereference in outer scope..

check("void foo(int x, const Token *tok) {\n"

" if (x == 123) {\n"

" while (tok) tok = tok->next();\n"

" }\n"

" tok->str();\n"

"}\n");

ASSERT_EQUALS("[test.cpp:3] -> [test.cpp:5]: (warning) Either the condition 'tok' is redundant or there is possible null pointer dereference: tok.\n", errout.str());

check("int foo(const Token *tok)\n"

"{\n"

" while (tok){;}\n"

"}\n", true);

ASSERT_EQUALS("", errout.str());

check("int foo(const Token *tok)\n"

"{\n"

" while (tok){;}\n"

" char a[2] = {0,0};\n"

"}\n", true);

ASSERT_EQUALS("", errout.str());

check("struct b {\n"

" b * c;\n"

" int i;\n"

"}\n"

"void a(b * e) {\n"

" for (b *d = e;d; d = d->c)\n"

" while (d && d->i == 0)\n"

" d = d->c;\n"

" if (!d) throw;\n"

"}\n");

ASSERT_EQUALS("", errout.str());

check("struct b {\n"

" b * c;\n"

" int i;\n"

"};\n"

"void f(b* e1, b* e2) {\n"

" for (const b* d = e1; d != e2; d = d->c) {\n"

" if (d && d->i != 0) {}\n"

" }\n"

"}\n");

ASSERT_EQUALS("[test.cpp:7] -> [test.cpp:6]: (warning) Either the condition 'd' is redundant or there is possible null pointer dereference: d.\n", errout.str());

}

void nullpointer1() {

// ticket #1923 - no false positive when using else if

check("void f(A *a)\n"

"{\n"

" if (a->x == 1)\n"

" {\n"

" a = a->next;\n"

" }\n"

" else if (a->x == 2) { }\n"

" if (a) { }\n"

"}");

ASSERT_EQUALS("", errout.str());

// ticket #2134 - sizeof doesn't dereference

check("void f() {\n"

" int c = 1;\n"

" int *list = NULL;\n"

" sizeof(*list);\n"

" if (!list)\n"

" ;\n"

"}", true);

ASSERT_EQUALS("", errout.str());

// ticket #2245 - sizeof doesn't dereference

check("void f(Bar *p) {\n"

" if (!p) {\n"

" int sz = sizeof(p->x);\n"

" }\n"

"}", true);

ASSERT_EQUALS("", errout.str());

}

void nullpointer2() {

// Null pointer dereference can only happen with pointers

check("void foo()\n"

"{\n"

" Fred fred;\n"

" while (fred);\n"

" fred.hello();\n"

"}", true);

ASSERT_EQUALS("", errout.str());

}

// Dereferencing a struct and then checking if it is null

// This is checked by this function:

// CheckOther::nullPointerStructByDeRefAndChec

void structDerefAndCheck() {

// errors..

check("void foo(struct ABC *abc)\n"

"{\n"

" int a = abc->a;\n"

" if (!abc)\n"

" ;\n"

"}");

ASSERT_EQUALS("[test.cpp:4] -> [test.cpp:3]: (warning) Either the condition '!abc' is redundant or there is possible null pointer dereference: abc.\n", errout.str());

check("void foo(struct ABC *abc) {\n"

" bar(abc->a);\n"

" bar(x, abc->a);\n"

" bar(x, y, abc->a);\n"

" if (!abc)\n"

" ;\n"

"}");

ASSERT_EQUALS("[test.cpp:5] -> [test.cpp:2]: (warning) Either the condition '!abc' is redundant or there is possible null pointer dereference: abc.\n"

"[test.cpp:5] -> [test.cpp:3]: (warning) Either the condition '!abc' is redundant or there is possible null pointer dereference: abc.\n"

"[test.cpp:5] -> [test.cpp:4]: (warning) Either the condition '!abc' is redundant or there is possible null pointer dereference: abc.\n", errout.str());

check("void foo(ABC *abc) {\n"

" if (abc->a == 3) {\n"

" return;\n"

" }\n"

" if (abc) {}\n"

"}");

ASSERT_EQUALS("[test.cpp:5] -> [test.cpp:2]: (warning) Either the condition 'if(abc)' is redundant or there is possible null pointer dereference: abc.\n", errout.str());

check("void f(ABC *abc) {\n"

" if (abc->x == 0) {\n"

" return;\n"

" }\n"

" if (!abc);\n"

"}");

ASSERT_EQUALS("[test.cpp:5] -> [test.cpp:2]: (warning) Either the condition '!abc' is redundant or there is possible null pointer dereference: abc.\n", errout.str());

// TODO: False negative if member of member is dereferenced

check("void foo(ABC *abc) {\n"

" abc->next->a = 0;\n"

" if (abc->next)\n"

" ;\n"

"}");

TODO_ASSERT_EQUALS("[test.cpp:3] -> [test.cpp:2]: (warning) Possible null pointer dereference: abc - otherwise it is redundant to check it against null.\n", "", errout.str());

check("void foo(ABC *abc) {\n"

" abc->a = 0;\n"

" if (abc && abc->b == 0)\n"

" ;\n"

"}");

ASSERT_EQUALS("[test.cpp:3] -> [test.cpp:2]: (warning) Either the condition 'if(abc&&abc->b==0)' is redundant or there is possible null pointer dereference: abc.\n", errout.str());

// ok dereferencing in a condition

check("void foo(struct ABC *abc)\n"

"{\n"

" if (abc && abc->a);\n"

" if (!abc)\n"

" ;\n"

"}");

ASSERT_EQUALS("", errout.str());

check("void f(struct ABC *abc) {\n"

" int x = abc && a(abc->x);\n"

" if (abc) { }\n"

"}");

ASSERT_EQUALS("", errout.str());

// ok to use a linked list..

check("void foo(struct ABC *abc)\n"

"{\n"

" abc = abc->next;\n"

" if (!abc)\n"

" ;\n"

"}", true);

ASSERT_EQUALS("", errout.str());

check("void f(struct ABC *abc) {\n"

" abc = (ABC *)(abc->_next);\n"

" if (abc) { }"

"}", true);

ASSERT_EQUALS("", errout.str());

// reassign struct..

check("void foo(struct ABC *abc)\n"

"{\n"

" int a = abc->a;\n"

" abc = abc->next;\n"

" if (!abc)\n"

" ;\n"

"}", true);

ASSERT_EQUALS("", errout.str());

check("void foo(struct ABC *abc)\n"

"{\n"

" int a = abc->a;\n"

" f(&abc);\n"

" if (!abc)\n"

" ;\n"

"}", true);

ASSERT_EQUALS("", errout.str());

// goto..

check("void foo(struct ABC *abc)\n"

"{\n"

" int a;\n"

" if (!abc)\n"

" goto out;"

" a = abc->a;\n"

" return;\n"

"out:\n"

" if (!abc)\n"

" ;\n"

"}");

ASSERT_EQUALS("", errout.str());

// loops..

check("void foo(struct ABC *abc)\n"

"{\n"

" int a = abc->a;"

" do\n"

" {\n"

" if (abc)\n"

" abc = abc->next;\n"

" --a;\n"

" }\n"

" while (a > 0);\n"

"}");

ASSERT_EQUALS("", errout.str());

check("void f()\n"

"{\n"

" for (const Token *tok = _tokenizer->tokens(); tok; tok = tok->next())\n"

" {\n"

" while (tok && tok->str() != \"{\")\n"

" tok = tok->next();\n"

" if (!tok)\n"

" return;\n"

" }\n"

"}");

ASSERT_EQUALS("", errout.str());

// dynamic_cast..

check("void foo(ABC *abc)\n"

"{\n"

" int a = abc->a;\n"

" if (!dynamic_cast<DEF *>(abc))\n"

" ;\n"

"}");

ASSERT_EQUALS("", errout.str());

// #2641 - global pointer, function call

check("ABC *abc;\n"

"void f() {\n"

" abc->a = 0;\n"

" do_stuff();\n"

" if (abc) { }\n"

"}");

ASSERT_EQUALS("",errout.str());

check("Fred *fred;\n"

"void f() {\n"

" fred->foo();\n"

" if (fred) { }\n"

"}");

ASSERT_EQUALS("",errout.str());

// #2641 - local pointer, function call

check("void f() {\n"

" ABC *abc = abc1;\n"

" abc->a = 0;\n"

" do_stuff();\n"

" if (abc) { }\n"

"}");

ASSERT_EQUALS("[test.cpp:5] -> [test.cpp:3]: (warning) Either the condition 'if(abc)' is redundant or there is possible null pointer dereference: abc.\n",errout.str());

// #2641 - local pointer, function call

check("void f(ABC *abc) {\n"

" abc->a = 0;\n"

" do_stuff();\n"

" if (abc) { }\n"

"}");

ASSERT_EQUALS("[test.cpp:4] -> [test.cpp:2]: (warning) Either the condition 'if(abc)' is redundant or there is possible null pointer dereference: abc.\n",errout.str());

// #2691 - switch/break

check("void f(ABC *abc) {\n"

" switch ( x ) {\n"

" case 14:\n"

" sprintf(buf, \"%d\", abc->a);\n"

" break;\n"

" case 15:\n"

" if ( abc ) {}\n"

" break;\n"

" }\n"

"}");

ASSERT_EQUALS("", errout.str());

// #3128

check("void f(ABC *abc) {\n"

" x(!abc || y(abc->a));\n"

" if (abc) {}\n"

"}");

ASSERT_EQUALS("", errout.str());

check("void f(ABC *abc) {\n"

" x(def || !abc || y(def, abc->a));\n"

" if (abc) {}\n"

"}");

ASSERT_EQUALS("", errout.str());

check("void f(ABC *abc) {\n"

" x(abc && y(def, abc->a));\n"

" if (abc) {}\n"

"}");

ASSERT_EQUALS("", errout.str());

check("void f(ABC *abc) {\n"

" x(def && abc && y(def, abc->a));\n"

" if (abc) {}\n"

"}");

ASSERT_EQUALS("", errout.str());

// #3228 - calling function with null object

{

const char code[] = "void f(Fred *fred) {\n"

" fred->x();\n"

" if (fred) { }\n"

"}";

check(code);

ASSERT_EQUALS("[test.cpp:3] -> [test.cpp:2]: (warning) Either the condition 'if(fred)' is redundant or there is possible null pointer dereference: fred.\n", errout.str());

}

// #3425 - false positives when there are macros

checkP("#define IF if\n"

"void f(struct FRED *fred) {\n"

" fred->x = 0;\n"

" IF(!fred){}\n"

"}");

ASSERT_EQUALS("", errout.str());

check("void foo() {\n"

" BUFFER *buffer = get_buffer();\n"

" if (!buffer)\n"

" uv_fatal_error();\n"

" buffer->x = 11;\n"

"}");

ASSERT_EQUALS("", errout.str());

}

// Dereferencing a pointer and then checking if it is null

void pointerDerefAndCheck() {

// errors..

check("void foo(int *p)\n"

"{\n"

" *p = 0;\n"

" if (!p)\n"

" ;\n"

"}");

ASSERT_EQUALS("[test.cpp:4] -> [test.cpp:3]: (warning) Either the condition '!p' is redundant or there is possible null pointer dereference: p.\n", errout.str());

check("void foo(int *p)\n"

"{\n"

" *p = 0;\n"

" if (p) { }\n"

"}");

ASSERT_EQUALS("[test.cpp:4] -> [test.cpp:3]: (warning) Either the condition 'if(p)' is redundant or there is possible null pointer dereference: p.\n", errout.str());

check("void foo(int *p)\n"

"{\n"

" *p = 0;\n"

" if (p || q) { }\n"

"}");

ASSERT_EQUALS("[test.cpp:4] -> [test.cpp:3]: (warning) Either the condition 'if(p||q)' is redundant or there is possible null pointer dereference: p.\n", errout.str());

check("void foo(int *p)\n"

"{\n"

" bar(*p);\n"

" if (!p)\n"

" ;\n"

"}");

ASSERT_EQUALS("[test.cpp:4] -> [test.cpp:3]: (warning) Either the condition '!p' is redundant or there is possible null pointer dereference: p.\n", errout.str());

check("void foo(char *p)\n"

"{\n"

" strcpy(p, \"abc\");\n"

" if (!p)\n"

" ;\n"

"}");

ASSERT_EQUALS("[test.cpp:4] -> [test.cpp:3]: (warning) Either the condition '!p' is redundant or there is possible null pointer dereference: p.\n", errout.str());

check("void foo(char *p)\n"

"{\n"

" if (*p == 0) { }\n"

" if (!p) { }\n"

"}");

ASSERT_EQUALS("[test.cpp:4] -> [test.cpp:3]: (warning) Either the condition '!p' is redundant or there is possible null pointer dereference: p.\n", errout.str());

// no error

check("void foo()\n"

"{\n"

" int *p;\n"

" f(&p);\n"

" if (!p)\n"

" ;\n"

"}");

ASSERT_EQUALS("", errout.str());

check("void foo()\n"

"{\n"

" int **p = f();\n"

" if (!p)\n"

" ;\n"

"}", true);

ASSERT_EQUALS("", errout.str());

check("void foo(int *p)\n"

"{\n"

" if (x)\n"

" p = 0;\n"

" else\n"

" *p = 0;\n"

" if (!p)\n"

" ;\n"

"}");

ASSERT_EQUALS("", errout.str());

check("void foo(int x)\n"

"{\n"

" int a = 2 * x;"

" if (x == 0)\n"

" ;\n"

"}", true);

ASSERT_EQUALS("", errout.str());

check("void foo(int *p)\n"

"{\n"

" int var1 = p ? *p : 0;\n"

" if (!p)\n"

" ;\n"

"}");

ASSERT_EQUALS("", errout.str());

check("void foo(int *p)\n"

"{\n"

" int var1 = x ? *p : 5;\n"

" if (!p)\n"

" ;\n"

"}");

ASSERT_EQUALS("[test.cpp:4] -> [test.cpp:3]: (warning) Either the condition '!p' is redundant or there is possible null pointer dereference: p.\n", errout.str());

// while

check("void f(int *p) {\n"

" *p = 0;\n"

" while (p) { p = 0; }\n"

"}");

ASSERT_EQUALS("", errout.str());

check("void f(int *p) {\n"

" *p = 0;\n"

" while (p) { }\n"

"}");

ASSERT_EQUALS("[test.cpp:3] -> [test.cpp:2]: (warning) Either the condition 'while(p)' is redundant or there is possible null pointer dereference: p.\n", errout.str());

// Ticket #3125

check("void foo(ABC *p)\n"

"{\n"

" int var1 = p ? (p->a) : 0;\n"

" if (!p)\n"

" ;\n"

"}");

ASSERT_EQUALS("", errout.str());

check("void foo(ABC *p)\n"

"{\n"

" int var1 = p ? (1 + p->a) : 0;\n"

" if (!p)\n"

" ;\n"

"}");

ASSERT_EQUALS("", errout.str());

check("void f() {\n"

" int * a=0;\n"

" if (!a) {};\n"

" int c = a ? 0 : 1;\n"

"}\n",true);

ASSERT_EQUALS("", errout.str());

// #3686

check("void f() {\n"

" int * a=0;\n"

" if (!a) {};\n"

" int c = a ? b : b+1;\n"

"}\n",true);

ASSERT_EQUALS("", errout.str());

check("void f() {\n"

" int * a=0;\n"

" if (!a) {};\n"

" int c = (a) ? b : b+1;\n"

"}\n",true);

ASSERT_EQUALS("", errout.str());

check("void foo(P *p)\n"

"{\n"

" while (p)\n"

" if (p->check())\n"

" break;\n"

" else\n"

" p = p->next();\n"

"}");

ASSERT_EQUALS("", errout.str());

check("void f(Document *doc) {\n"

" int x = doc && doc->x;\n"

" if (!doc) {\n"

" return;\n"

" }\n"

"}");

ASSERT_EQUALS("", errout.str());

// #3128 - false positive

check("void f(int *p) {\n"

" assert(!p || (*p<=6));\n"

" if (p) { *p = 0; }\n"

"}");

ASSERT_EQUALS("", errout.str());

check("void f(int *p) {\n"

" assert(p && (*p<=6));\n"

" if (p) { *p = 0; }\n"

"}");

ASSERT_EQUALS("", errout.str());

check("void f(int *p) {\n"

" *p = 12;\n"

" assert(p && (*p<=6));\n"

" if (p) { *p = 0; }\n"

"}");

ASSERT_EQUALS("[test.cpp:4] -> [test.cpp:2]: (warning) Either the condition 'if(p)' is redundant or there is possible null pointer dereference: p.\n", errout.str());

check("void foo(x *p)\n"

"{\n"

" p = p->next;\n"

" if (!p)\n"

" ;\n"

"}");

ASSERT_EQUALS("", errout.str());

check("void foo(x *p)\n"

"{\n"

" p = bar(p->next);\n"

" if (!p)\n"

" ;\n"

"}");

ASSERT_EQUALS("", errout.str());

check("void foo(x *p)\n"

"{\n"

" p = aa->bar(p->next);\n"

" if (!p)\n"

" ;\n"

"}");

ASSERT_EQUALS("", errout.str());

check("void foo(x *p)\n"

"{\n"

" p = *p2 = p->next;\n"

" if (!p)\n"

" ;\n"

"}");

ASSERT_EQUALS("", errout.str());

check("void foo(struct ABC *abc)\n"

"{\n"

" abc = abc ? abc->next : 0;\n"

" if (!abc)\n"

" ;\n"

"}");

ASSERT_EQUALS("", errout.str());

check("void f(struct ABC *abc) {\n" // #4523

" abc = (*abc).next;\n"

" if (abc) { }\n"

"}");

ASSERT_EQUALS("", errout.str());

check("void f(struct ABC *abc) {\n" // #4523

" abc = (*abc->ptr);\n"

" if (abc) { }\n"

"}");

ASSERT_EQUALS("", errout.str());

check("int f(Item *item) {\n"

" x = item ? ab(item->x) : 0;\n"

" if (item) { }\n"

"}");

ASSERT_EQUALS("", errout.str());

check("int f(Item *item) {\n"

" item->x = 0;\n"

" a = b ? c : d;\n"

" if (item) { }\n"

"}");

ASSERT_EQUALS("[test.cpp:4] -> [test.cpp:2]: (warning) Either the condition 'if(item)' is redundant or there is possible null pointer dereference: item.\n", errout.str());

check("BOOL GotoFlyAnchor()\n" // #2243

"{\n"

" const SwFrm* pFrm = GetCurrFrm();\n"

" do {\n"

" pFrm = pFrm->GetUpper();\n"

" } while( pFrm && !pFrm->IsFlyFrm() );\n"

"\n"

" if( !pFrm )\n"

" return FALSE;\n"

"}");

ASSERT_EQUALS("", errout.str());

// Ticket #2463

check("struct A\n"

"{\n"

" B* W;\n"

"\n"

" void f() {\n"

" switch (InData) {\n"

" case 2:\n"

" if (!W) return;\n"

" W->foo();\n"

" break;\n"

" case 3:\n"

" f();\n"

" if (!W) return;\n"

" break;\n"

" }\n"

" }\n"

"}");

ASSERT_EQUALS("", errout.str());

// #2525 - sizeof

check("void f() {\n"

" int *test = NULL;\n"

" int c = sizeof(test[0]);\n"

" if (!test)\n"

" ;\n"

"}", true);

ASSERT_EQUALS("", errout.str());

check("void f(type* p) {\n" // #4983

" x(sizeof p[0]);\n"

" if (!p)\n"

" ;\n"

"}");

ASSERT_EQUALS("", errout.str());

// #3023 - checked deref

check("void f(struct ABC *abc) {\n"

" WARN_ON(!abc || abc->x == 0);\n"

" if (!abc) { }\n"

"}");

ASSERT_EQUALS("", errout.str());

check("void f(struct ABC *abc) {\n"

" WARN_ON(!abc || abc->x == 7);\n"

" if (!abc) { }\n"

"}");

ASSERT_EQUALS("", errout.str());

// #3425 - false positives when there are macros

checkP("#define IF if\n"

"void f(int *p) {\n"

" *p = 0;\n"

" IF(!p){}\n"

"}");

ASSERT_EQUALS("", errout.str());

check("void f() {\n" // #3914 - false positive

" int *p;\n"

" ((p=ret()) && (x=*p));\n"

" if (p);\n"

"}");

ASSERT_EQUALS("", errout.str());

}

void nullpointer5() {

// errors..

check("void foo(A &a)\n"

"{\n"

" char c = a.c();\n"

" if (!a)\n"

" return;\n"

"}");

ASSERT_EQUALS("", errout.str());

}

// Execution paths..

void nullpointerExecutionPaths() {

// errors..

check("static void foo()\n"

"{\n"

" Foo *p = 0;\n"

" if (a == 1) {\n"

" p = new FooBar;\n"

" } else { if (a == 2) {\n"

" p = new FooCar; } }\n"

" p->abcd();\n"

"}");

TODO_ASSERT_EQUALS("[test.cpp:8]: (error) Possible null pointer dereference: p\n",

"", errout.str());

check("static void foo() {\n"

" int &r = *0;\n"

"}");

ASSERT_EQUALS("[test.cpp:2]: (error) Null pointer dereference\n", errout.str());

check("static void foo(int x) {\n"

" int y = 5 + *0;\n"

"}");

ASSERT_EQUALS("[test.cpp:2]: (error) Null pointer dereference\n", errout.str());

{

const char code[] = "static void foo() {\n"

" Foo<int> *abc = 0;\n"

" abc->a();\n"

"}\n";

check(code);

ASSERT_EQUALS("[test.cpp:3]: (error) Null pointer dereference: abc\n", errout.str());

}

check("static void foo() {\n"

" std::cout << *0;"

"}");

ASSERT_EQUALS("[test.cpp:2]: (error) Null pointer dereference\n", errout.str());

check("void f()\n"

"{\n"

" char *c = 0;\n"

" {\n"

" delete c;\n"

" }\n"

" c[0] = 0;\n"

"}");

ASSERT_EQUALS("[test.cpp:7]: (error) Null pointer dereference: c\n", errout.str());

check("static void foo() {\n"

" if (3 > *0);\n"

"}");

ASSERT_EQUALS("[test.cpp:2]: (error) Null pointer dereference\n", errout.str());

// no false positive..