/*

* Cppcheck - A tool for static C/C++ code analysis

* Copyright (C) 2007-2021 Cppcheck team.

*

* This program is free software: you can redistribute it and/or modify

* it under the terms of the GNU General Public License as published by

* the Free Software Foundation, either version 3 of the License, or

* (at your option) any later version.

*

* This program is distributed in the hope that it will be useful,

* but WITHOUT ANY WARRANTY; without even the implied warranty of

* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

* GNU General Public License for more details.

*

* You should have received a copy of the GNU General Public License

* along with this program. If not, see <http://www.gnu.org/licenses/>.

*/

//---------------------------------------------------------------------------

#include "checkother.h"

#include "checkuninitvar.h" // CheckUninitVar::isVariableUsage

#include "astutils.h"

#include "library.h"

#include "mathlib.h"

#include "settings.h"

#include "standards.h"

#include "symboldatabase.h"

#include "token.h"

#include "tokenize.h"

#include "utils.h"

#include "valueflow.h"

#include <algorithm> // find_if()

#include <list>

#include <map>

#include <ostream>

#include <utility>

//---------------------------------------------------------------------------

// Register this check class (by creating a static instance of it)

namespace {

CheckOther instance;

}

static const struct CWE CWE128(128U); // Wrap-around Error

static const struct CWE CWE131(131U); // Incorrect Calculation of Buffer Size

static const struct CWE CWE197(197U); // Numeric Truncation Error

static const struct CWE CWE362(362U); // Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

static const struct CWE CWE369(369U); // Divide By Zero

static const struct CWE CWE398(398U); // Indicator of Poor Code Quality

static const struct CWE CWE475(475U); // Undefined Behavior for Input to API

static const struct CWE CWE482(482U); // Comparing instead of Assigning

static const struct CWE CWE561(561U); // Dead Code

static const struct CWE CWE563(563U); // Assignment to Variable without Use ('Unused Variable')

static const struct CWE CWE570(570U); // Expression is Always False

static const struct CWE CWE571(571U); // Expression is Always True

static const struct CWE CWE672(672U); // Operation on a Resource after Expiration or Release

static const struct CWE CWE628(628U); // Function Call with Incorrectly Specified Arguments

static const struct CWE CWE683(683U); // Function Call With Incorrect Order of Arguments

static const struct CWE CWE686(686U); // Function Call With Incorrect Argument Type

static const struct CWE CWE704(704U); // Incorrect Type Conversion or Cast

static const struct CWE CWE758(758U); // Reliance on Undefined, Unspecified, or Implementation-Defined Behavior

static const struct CWE CWE768(768U); // Incorrect Short Circuit Evaluation

static const struct CWE CWE783(783U); // Operator Precedence Logic Error

//----------------------------------------------------------------------------------

// The return value of fgetc(), getc(), ungetc(), getchar() etc. is an integer value.

// If this return value is stored in a character variable and then compared

// to EOF, which is an integer, the comparison maybe be false.

//

// Reference:

// - Ticket #160

// - http://www.cplusplus.com/reference/cstdio/fgetc/

// - http://www.cplusplus.com/reference/cstdio/getc/

// - http://www.cplusplus.com/reference/cstdio/getchar/

// - http://www.cplusplus.com/reference/cstdio/ungetc/ ...

//----------------------------------------------------------------------------------

void CheckOther::checkCastIntToCharAndBack()

{

if (!mSettings->severity.isEnabled(Severity::warning))

return;

const SymbolDatabase *symbolDatabase = mTokenizer->getSymbolDatabase();

for (const Scope * scope : symbolDatabase->functionScopes) {

std::map<int, std::string> vars;

for (const Token* tok = scope->bodyStart->next(); tok != scope->bodyEnd; tok = tok->next()) {

// Quick check to see if any of the matches below have any chances

if (!Token::Match(tok, "%var%|EOF %comp%|="))

continue;

if (Token::Match(tok, "%var% = fclose|fflush|fputc|fputs|fscanf|getchar|getc|fgetc|putchar|putc|puts|scanf|sscanf|ungetc (")) {

const Variable *var = tok->variable();

if (var && var->typeEndToken()->str() == "char" && !var->typeEndToken()->isSigned()) {

vars[tok->varId()] = tok->strAt(2);

}

} else if (Token::Match(tok, "EOF %comp% ( %var% = fclose|fflush|fputc|fputs|fscanf|getchar|getc|fgetc|putchar|putc|puts|scanf|sscanf|ungetc (")) {

tok = tok->tokAt(3);

const Variable *var = tok->variable();

if (var && var->typeEndToken()->str() == "char" && !var->typeEndToken()->isSigned()) {

checkCastIntToCharAndBackError(tok, tok->strAt(2));

}

} else if (mTokenizer->isCPP() && (Token::Match(tok, "EOF %comp% ( %var% = std :: cin . get (") || Token::Match(tok, "EOF %comp% ( %var% = cin . get ("))) {

tok = tok->tokAt(3);

const Variable *var = tok->variable();

if (var && var->typeEndToken()->str() == "char" && !var->typeEndToken()->isSigned()) {

checkCastIntToCharAndBackError(tok, "cin.get");

}

} else if (mTokenizer->isCPP() && (Token::Match(tok, "%var% = std :: cin . get (") || Token::Match(tok, "%var% = cin . get ("))) {

const Variable *var = tok->variable();

if (var && var->typeEndToken()->str() == "char" && !var->typeEndToken()->isSigned()) {

vars[tok->varId()] = "cin.get";

}

} else if (Token::Match(tok, "%var% %comp% EOF")) {

if (vars.find(tok->varId()) != vars.end()) {

checkCastIntToCharAndBackError(tok, vars[tok->varId()]);

}

} else if (Token::Match(tok, "EOF %comp% %var%")) {

tok = tok->tokAt(2);

if (vars.find(tok->varId()) != vars.end()) {

checkCastIntToCharAndBackError(tok, vars[tok->varId()]);

}

}

}

}

}

void CheckOther::checkCastIntToCharAndBackError(const Token *tok, const std::string &strFunctionName)

{

reportError(

tok,

Severity::warning,

"checkCastIntToCharAndBack",

"$symbol:" + strFunctionName + "\n"

"Storing $symbol() return value in char variable and then comparing with EOF.\n"

"When saving $symbol() return value in char variable there is loss of precision. "

" When $symbol() returns EOF this value is truncated. Comparing the char "

"variable with EOF can have unexpected results. For instance a loop \"while (EOF != (c = $symbol());\" "

"loops forever on some compilers/platforms and on other compilers/platforms it will stop "

"when the file contains a matching character.", CWE197, Certainty::normal

);

}

//---------------------------------------------------------------------------

// Clarify calculation precedence for ternary operators.

//---------------------------------------------------------------------------

void CheckOther::clarifyCalculation()

{

if (!mSettings->severity.isEnabled(Severity::style))

return;

const SymbolDatabase *symbolDatabase = mTokenizer->getSymbolDatabase();

for (const Scope * scope : symbolDatabase->functionScopes) {

for (const Token* tok = scope->bodyStart->next(); tok != scope->bodyEnd; tok = tok->next()) {

// ? operator where lhs is arithmetical expression

if (tok->str() != "?" || !tok->astOperand1() || !tok->astOperand1()->isCalculation())

continue;

if (!tok->astOperand1()->isArithmeticalOp() && tok->astOperand1()->tokType() != Token::eBitOp)

continue;

// non-pointer calculation in lhs and pointer in rhs => no clarification is needed

if (tok->astOperand1()->isBinaryOp() && Token::Match(tok->astOperand1(), "%or%|&|%|*|/") && tok->astOperand2()->valueType() && tok->astOperand2()->valueType()->pointer > 0)

continue;

// bit operation in lhs and char literals in rhs => probably no mistake

if (tok->astOperand1()->tokType() == Token::eBitOp && Token::Match(tok->astOperand2()->astOperand1(), "%char%") && Token::Match(tok->astOperand2()->astOperand2(), "%char%"))

continue;

// 2nd operand in lhs has known integer value => probably no mistake

if (tok->astOperand1()->isBinaryOp() && tok->astOperand1()->astOperand2()->hasKnownIntValue()) {

const Token *op = tok->astOperand1()->astOperand2();

if (op->isNumber())

continue;

if (op->valueType() && op->valueType()->isEnum())

continue;

}

// Is code clarified by parentheses already?

const Token *tok2 = tok->astOperand1();

for (; tok2; tok2 = tok2->next()) {

if (tok2->str() == "(")

tok2 = tok2->link();

else if (tok2->str() == ")")

break;

else if (tok2->str() == "?") {

clarifyCalculationError(tok, tok->astOperand1()->str());

break;

}

}

}

}

}

void CheckOther::clarifyCalculationError(const Token *tok, const std::string &op)

{

// suspicious calculation

const std::string calc("'a" + op + "b?c:d'");

// recommended calculation #1

const std::string s1("'(a" + op + "b)?c:d'");

// recommended calculation #2

const std::string s2("'a" + op + "(b?c:d)'");

reportError(tok,

Severity::style,

"clarifyCalculation",

"Clarify calculation precedence for '" + op + "' and '?'.\n"

"Suspicious calculation. Please use parentheses to clarify the code. "

"The code '" + calc + "' should be written as either '" + s1 + "' or '" + s2 + "'.", CWE783, Certainty::normal);

}

//---------------------------------------------------------------------------

// Clarify (meaningless) statements like *foo++; with parentheses.

//---------------------------------------------------------------------------

void CheckOther::clarifyStatement()

{

if (!mSettings->severity.isEnabled(Severity::warning))

return;

const SymbolDatabase *symbolDatabase = mTokenizer->getSymbolDatabase();

for (const Scope * scope : symbolDatabase->functionScopes) {

for (const Token* tok = scope->bodyStart; tok && tok != scope->bodyEnd; tok = tok->next()) {

if (Token::Match(tok, "* %name%") && tok->astOperand1()) {

const Token *tok2 = tok->previous();

while (tok2 && tok2->str() == "*")

tok2 = tok2->previous();

if (tok2 && !tok2->astParent() && Token::Match(tok2, "[{};]")) {

tok2 = tok->astOperand1();

if (Token::Match(tok2, "++|-- [;,]"))

clarifyStatementError(tok2);

}

}

}

}

}

void CheckOther::clarifyStatementError(const Token *tok)

{

reportError(tok, Severity::warning, "clarifyStatement", "In expression like '*A++' the result of '*' is unused. Did you intend to write '(*A)++;'?\n"

"A statement like '*A++;' might not do what you intended. Postfix 'operator++' is executed before 'operator*'. "

"Thus, the dereference is meaningless. Did you intend to write '(*A)++;'?", CWE783, Certainty::normal);

}

//---------------------------------------------------------------------------

// Check for suspicious occurrences of 'if(); {}'.

//---------------------------------------------------------------------------

void CheckOther::checkSuspiciousSemicolon()

{

if (!mSettings->certainty.isEnabled(Certainty::inconclusive) || !mSettings->severity.isEnabled(Severity::warning))

return;

const SymbolDatabase* const symbolDatabase = mTokenizer->getSymbolDatabase();

// Look for "if(); {}", "for(); {}" or "while(); {}"

for (const Scope &scope : symbolDatabase->scopeList) {

if (scope.type == Scope::eIf || scope.type == Scope::eElse || scope.type == Scope::eWhile || scope.type == Scope::eFor) {

// Ensure the semicolon is at the same line number as the if/for/while statement

// and the {..} block follows it without an extra empty line.

if (Token::simpleMatch(scope.bodyStart, "{ ; } {") &&

scope.bodyStart->previous()->linenr() == scope.bodyStart->tokAt(2)->linenr() &&

scope.bodyStart->linenr()+1 >= scope.bodyStart->tokAt(3)->linenr() &&

!scope.bodyStart->tokAt(3)->isExpandedMacro()) {

suspiciousSemicolonError(scope.classDef);

}

}

}

}

void CheckOther::suspiciousSemicolonError(const Token* tok)

{

reportError(tok, Severity::warning, "suspiciousSemicolon",

"Suspicious use of ; at the end of '" + (tok ? tok->str() : std::string()) + "' statement.", CWE398, Certainty::normal);

}

//---------------------------------------------------------------------------

// For C++ code, warn if C-style casts are used on pointer types

//---------------------------------------------------------------------------

void CheckOther::warningOldStylePointerCast()

{

// Only valid on C++ code

if (!mSettings->severity.isEnabled(Severity::style) || !mTokenizer->isCPP())

return;

const SymbolDatabase *symbolDatabase = mTokenizer->getSymbolDatabase();

for (const Scope * scope : symbolDatabase->functionScopes) {

const Token* tok;

if (scope->function && scope->function->isConstructor())

tok = scope->classDef;

else

tok = scope->bodyStart;

for (; tok && tok != scope->bodyEnd; tok = tok->next()) {

// Old style pointer casting..

if (!Token::Match(tok, "( const|volatile| const|volatile| %type% * const| ) (| %name%|%num%|%bool%|%char%|%str%"))

continue;

// skip first "const" in "const Type* const"

while (Token::Match(tok->next(), "const|volatile"))

tok = tok->next();

const Token* typeTok = tok->next();

// skip second "const" in "const Type* const"

if (tok->strAt(3) == "const")

tok = tok->next();

const Token *p = tok->tokAt(4);

if (p->hasKnownIntValue() && p->values().front().intvalue==0) // Casting nullpointers is safe

continue;

// Is "type" a class?

if (typeTok->type())

cstyleCastError(tok);

}

}

}

void CheckOther::cstyleCastError(const Token *tok)

{

reportError(tok, Severity::style, "cstyleCast",

"C-style pointer casting\n"

"C-style pointer casting detected. C++ offers four different kinds of casts as replacements: "

"static_cast, const_cast, dynamic_cast and reinterpret_cast. A C-style cast could evaluate to "

"any of those automatically, thus it is considered safer if the programmer explicitly states "

"which kind of cast is expected. See also: https://www.securecoding.cert.org/confluence/display/cplusplus/EXP05-CPP.+Do+not+use+C-style+casts.", CWE398, Certainty::normal);

}

//---------------------------------------------------------------------------

// float* f; double* d = (double*)f; <-- Pointer cast to a type with an incompatible binary data representation

//---------------------------------------------------------------------------

void CheckOther::invalidPointerCast()

{

if (!mSettings->severity.isEnabled(Severity::portability))

return;

const bool printInconclusive = mSettings->certainty.isEnabled(Certainty::inconclusive);

const SymbolDatabase* const symbolDatabase = mTokenizer->getSymbolDatabase();

for (const Scope * scope : symbolDatabase->functionScopes) {

for (const Token* tok = scope->bodyStart->next(); tok != scope->bodyEnd; tok = tok->next()) {

const Token* toTok = nullptr;

const Token* fromTok = nullptr;

// Find cast

if (Token::Match(tok, "( const|volatile| const|volatile| %type% %type%| const| * )")) {

toTok = tok;

fromTok = tok->astOperand1();

} else if (Token::simpleMatch(tok, "reinterpret_cast <") && tok->linkAt(1)) {

toTok = tok->linkAt(1)->next();

fromTok = toTok->astOperand2();

}

if (!fromTok)

continue;

const ValueType* fromType = fromTok->valueType();

const ValueType* toType = toTok->valueType();

if (!fromType || !toType || !fromType->pointer || !toType->pointer)

continue;

if (fromType->type != toType->type && fromType->type >= ValueType::Type::BOOL && toType->type >= ValueType::Type::BOOL && (toType->type != ValueType::Type::CHAR || printInconclusive)) {

if (toType->isIntegral() && fromType->isIntegral())

continue;

invalidPointerCastError(tok, fromType->str(), toType->str(), toType->type == ValueType::Type::CHAR, toType->isIntegral());

}

}

}

}

void CheckOther::invalidPointerCastError(const Token* tok, const std::string& from, const std::string& to, bool inconclusive, bool toIsInt)

{

if (toIsInt) { // If we cast something to int*, this can be useful to play with its binary data representation

reportError(tok, Severity::portability, "invalidPointerCast", "Casting from " + from + " to " + to + " is not portable due to different binary data representations on different platforms.", CWE704, inconclusive ? Certainty::inconclusive : Certainty::normal);

} else

reportError(tok, Severity::portability, "invalidPointerCast", "Casting between " + from + " and " + to + " which have an incompatible binary data representation.", CWE704, Certainty::normal);

}

//---------------------------------------------------------------------------

// This check detects errors on POSIX systems, when a pipe command called

// with a wrong dimensioned file descriptor array. The pipe command requires

// exactly an integer array of dimension two as parameter.

//

// References:

// - http://linux.die.net/man/2/pipe

// - ticket #3521

//---------------------------------------------------------------------------

void CheckOther::checkPipeParameterSize()

{

if (!mSettings->posix())

return;

const SymbolDatabase *symbolDatabase = mTokenizer->getSymbolDatabase();

for (const Scope * scope : symbolDatabase->functionScopes) {

for (const Token* tok = scope->bodyStart->next(); tok != scope->bodyEnd; tok = tok->next()) {

if (Token::Match(tok, "pipe ( %var% )") ||

Token::Match(tok, "pipe2 ( %var% ,")) {

const Token * const varTok = tok->tokAt(2);

const Variable *var = varTok->variable();

MathLib::bigint dim;

if (var && var->isArray() && !var->isArgument() && ((dim=var->dimension(0U)) < 2)) {

const std::string strDim = MathLib::toString(dim);

checkPipeParameterSizeError(varTok,varTok->str(), strDim);

}

}

}

}

}

void CheckOther::checkPipeParameterSizeError(const Token *tok, const std::string &strVarName, const std::string &strDim)

{

reportError(tok, Severity::error,

"wrongPipeParameterSize",

"$symbol:" + strVarName + "\n"

"Buffer '$symbol' must have size of 2 integers if used as parameter of pipe().\n"

"The pipe()/pipe2() system command takes an argument, which is an array of exactly two integers.\n"

"The variable '$symbol' is an array of size " + strDim + ", which does not match.", CWE686, Certainty::safe);

}

//---------------------------------------------------------------------------

// Detect redundant assignments: x = 0; x = 4;

//---------------------------------------------------------------------------

void CheckOther::checkRedundantAssignment()

{

if (!mSettings->severity.isEnabled(Severity::style))

return;

const SymbolDatabase* symbolDatabase = mTokenizer->getSymbolDatabase();

for (const Scope *scope : symbolDatabase->functionScopes) {

if (!scope->bodyStart)

continue;

for (const Token* tok = scope->bodyStart->next(); tok != scope->bodyEnd; tok = tok->next()) {

if (Token::simpleMatch(tok, "] ("))

// todo: handle lambdas

break;

if (Token::simpleMatch(tok, "try {"))

// todo: check try blocks

tok = tok->linkAt(1);

if ((tok->isAssignmentOp() || Token::Match(tok, "++|--")) && tok->astOperand1()) {

if (tok->astParent())

continue;

// Do not warn about redundant initialization when rhs is trivial

// TODO : do not simplify the variable declarations

bool isInitialization = false;

if (Token::Match(tok->tokAt(-2), "; %var% =") && tok->tokAt(-2)->isSplittedVarDeclEq()) {

isInitialization = true;

bool trivial = true;

visitAstNodes(tok->astOperand2(),

[&](const Token *rhs) {

if (Token::simpleMatch(rhs, "{ 0 }"))

return ChildrenToVisit::none;

if (Token::Match(rhs, "%str%|%num%|%name%") && !rhs->varId())

return ChildrenToVisit::none;

if (Token::Match(rhs, ":: %name%") && rhs->hasKnownIntValue())

return ChildrenToVisit::none;

if (rhs->isCast())

return ChildrenToVisit::op2;

trivial = false;

return ChildrenToVisit::done;

});

if (trivial)

continue;

}

const Token* rhs = tok->astOperand2();

// Do not warn about assignment with 0 / NULL

if ((rhs && MathLib::isNullValue(rhs->str())) || isNullOperand(rhs))

continue;

if (tok->astOperand1()->variable() && tok->astOperand1()->variable()->isReference())

// todo: check references

continue;

if (tok->astOperand1()->variable() && tok->astOperand1()->variable()->isStatic())

// todo: check static variables

continue;

// If there is a custom assignment operator => this is inconclusive

bool inconclusive = false;

if (mTokenizer->isCPP() && tok->astOperand1()->valueType() && tok->astOperand1()->valueType()->typeScope) {

const std::string op = "operator" + tok->str();

for (const Function &f : tok->astOperand1()->valueType()->typeScope->functionList) {

if (f.name() == op) {

inconclusive = true;

break;

}

}

}

if (inconclusive && !mSettings->certainty.isEnabled(Certainty::inconclusive))

continue;

FwdAnalysis fwdAnalysis(mTokenizer->isCPP(), mSettings->library);

if (fwdAnalysis.hasOperand(tok->astOperand2(), tok->astOperand1()))

continue;

// Is there a redundant assignment?

const Token *start;

if (tok->isAssignmentOp())

start = tok->next();

else

start = tok->findExpressionStartEndTokens().second->next();

// Get next assignment..

const Token *nextAssign = fwdAnalysis.reassign(tok->astOperand1(), start, scope->bodyEnd);

if (!nextAssign)

continue;

// there is redundant assignment. Is there a case between the assignments?

bool hasCase = false;

for (const Token *tok2 = tok; tok2 != nextAssign; tok2 = tok2->next()) {

if (tok2->str() == "break" || tok2->str() == "return")

break;

if (tok2->str() == "case") {

hasCase = true;

break;

}

}

// warn

if (hasCase)

redundantAssignmentInSwitchError(tok, nextAssign, tok->astOperand1()->expressionString());

else if (isInitialization)

redundantInitializationError(tok, nextAssign, tok->astOperand1()->expressionString(), inconclusive);

else

redundantAssignmentError(tok, nextAssign, tok->astOperand1()->expressionString(), inconclusive);

}

}

}

}

void CheckOther::redundantCopyError(const Token *tok1, const Token* tok2, const std::string& var)

{

const std::list<const Token *> callstack = { tok1, tok2 };

reportError(callstack, Severity::performance, "redundantCopy",

"$symbol:" + var + "\n"

"Buffer '$symbol' is being written before its old content has been used.", CWE563, Certainty::normal);

}

void CheckOther::redundantCopyInSwitchError(const Token *tok1, const Token* tok2, const std::string &var)

{

const std::list<const Token *> callstack = { tok1, tok2 };

reportError(callstack, Severity::style, "redundantCopyInSwitch",

"$symbol:" + var + "\n"

"Buffer '$symbol' is being written before its old content has been used. 'break;' missing?", CWE563, Certainty::normal);

}

void CheckOther::redundantAssignmentError(const Token *tok1, const Token* tok2, const std::string& var, bool inconclusive)

{

const ErrorPath errorPath = { ErrorPathItem(tok1, var + " is assigned"), ErrorPathItem(tok2, var + " is overwritten") };

if (inconclusive)

reportError(errorPath, Severity::style, "redundantAssignment",

"$symbol:" + var + "\n"

"Variable '$symbol' is reassigned a value before the old one has been used if variable is no semaphore variable.\n"

"Variable '$symbol' is reassigned a value before the old one has been used. Make sure that this variable is not used like a semaphore in a threading environment before simplifying this code.", CWE563, Certainty::inconclusive);

else

reportError(errorPath, Severity::style, "redundantAssignment",

"$symbol:" + var + "\n"

"Variable '$symbol' is reassigned a value before the old one has been used.", CWE563, Certainty::normal);

}

void CheckOther::redundantInitializationError(const Token *tok1, const Token* tok2, const std::string& var, bool inconclusive)

{

const ErrorPath errorPath = { ErrorPathItem(tok1, var + " is initialized"), ErrorPathItem(tok2, var + " is overwritten") };

reportError(errorPath, Severity::style, "redundantInitialization",

"$symbol:" + var + "\nRedundant initialization for '$symbol'. The initialized value is overwritten before it is read.",

CWE563,

inconclusive ? Certainty::inconclusive : Certainty::normal);

}

void CheckOther::redundantAssignmentInSwitchError(const Token *tok1, const Token* tok2, const std::string &var)

{

const ErrorPath errorPath = { ErrorPathItem(tok1, "$symbol is assigned"), ErrorPathItem(tok2, "$symbol is overwritten") };

reportError(errorPath, Severity::style, "redundantAssignInSwitch",

"$symbol:" + var + "\n"

"Variable '$symbol' is reassigned a value before the old one has been used. 'break;' missing?", CWE563, Certainty::normal);

}

//---------------------------------------------------------------------------

// switch (x)

// {

// case 2:

// y = a; // <- this assignment is redundant

// case 3:

// y = b; // <- case 2 falls through and sets y twice

// }

//---------------------------------------------------------------------------

static inline bool isFunctionOrBreakPattern(const Token *tok)

{

if (Token::Match(tok, "%name% (") || Token::Match(tok, "break|continue|return|exit|goto|throw"))

return true;

return false;

}

void CheckOther::checkRedundantAssignmentInSwitch()

{

if (!mSettings->severity.isEnabled(Severity::warning))

return;

const SymbolDatabase *symbolDatabase = mTokenizer->getSymbolDatabase();

// Find the beginning of a switch. E.g.:

// switch (var) { ...

for (const Scope &switchScope : symbolDatabase->scopeList) {

if (switchScope.type != Scope::eSwitch || !switchScope.bodyStart)

continue;

// Check the contents of the switch statement

std::map<int, const Token*> varsWithBitsSet;

std::map<int, std::string> bitOperations;

for (const Token *tok2 = switchScope.bodyStart->next(); tok2 != switchScope.bodyEnd; tok2 = tok2->next()) {

if (tok2->str() == "{") {

// Inside a conditional or loop. Don't mark variable accesses as being redundant. E.g.:

// case 3: b = 1;

// case 4: if (a) { b = 2; } // Doesn't make the b=1 redundant because it's conditional

if (Token::Match(tok2->previous(), ")|else {") && tok2->link()) {

const Token* endOfConditional = tok2->link();

for (const Token* tok3 = tok2; tok3 != endOfConditional; tok3 = tok3->next()) {

if (tok3->varId() != 0) {

varsWithBitsSet.erase(tok3->varId());

bitOperations.erase(tok3->varId());

} else if (isFunctionOrBreakPattern(tok3)) {

varsWithBitsSet.clear();

bitOperations.clear();

}

}

tok2 = endOfConditional;

}

}

// Variable assignment. Report an error if it's assigned to twice before a break. E.g.:

// case 3: b = 1; // <== redundant

// case 4: b = 2;

if (Token::Match(tok2->previous(), ";|{|}|: %var% = %any% ;")) {

varsWithBitsSet.erase(tok2->varId());

bitOperations.erase(tok2->varId());

}

// Bitwise operation. Report an error if it's performed twice before a break. E.g.:

// case 3: b |= 1; // <== redundant

// case 4: b |= 1;

else if (Token::Match(tok2->previous(), ";|{|}|: %var% %assign% %num% ;") &&

(tok2->strAt(1) == "|=" || tok2->strAt(1) == "&=") &&

Token::Match(tok2->next()->astOperand2(), "%num%")) {

const std::string bitOp = tok2->strAt(1)[0] + tok2->strAt(2);

const std::map<int, const Token*>::const_iterator i2 = varsWithBitsSet.find(tok2->varId());

// This variable has not had a bit operation performed on it yet, so just make a note of it

if (i2 == varsWithBitsSet.end()) {

varsWithBitsSet[tok2->varId()] = tok2;

bitOperations[tok2->varId()] = bitOp;

}

// The same bit operation has been performed on the same variable twice, so report an error

else if (bitOperations[tok2->varId()] == bitOp)

redundantBitwiseOperationInSwitchError(i2->second, i2->second->str());

// A different bit operation was performed on the variable, so clear it

else {

varsWithBitsSet.erase(tok2->varId());

bitOperations.erase(tok2->varId());

}

}

// Bitwise operation. Report an error if it's performed twice before a break. E.g.:

// case 3: b = b | 1; // <== redundant

// case 4: b = b | 1;

else if (Token::Match(tok2->previous(), ";|{|}|: %var% = %name% %or%|& %num% ;") &&

tok2->varId() == tok2->tokAt(2)->varId()) {

const std::string bitOp = tok2->strAt(3) + tok2->strAt(4);

const std::map<int, const Token*>::const_iterator i2 = varsWithBitsSet.find(tok2->varId());

// This variable has not had a bit operation performed on it yet, so just make a note of it

if (i2 == varsWithBitsSet.end()) {

varsWithBitsSet[tok2->varId()] = tok2;

bitOperations[tok2->varId()] = bitOp;

}

// The same bit operation has been performed on the same variable twice, so report an error

else if (bitOperations[tok2->varId()] == bitOp)

redundantBitwiseOperationInSwitchError(i2->second, i2->second->str());

// A different bit operation was performed on the variable, so clear it

else {

varsWithBitsSet.erase(tok2->varId());

bitOperations.erase(tok2->varId());

}

}

// Not a simple assignment so there may be good reason if this variable is assigned to twice. E.g.:

// case 3: b = 1;

// case 4: b++;

else if (tok2->varId() != 0 && tok2->strAt(1) != "|" && tok2->strAt(1) != "&") {

varsWithBitsSet.erase(tok2->varId());

bitOperations.erase(tok2->varId());

}

// Reset our record of assignments if there is a break or function call. E.g.:

// case 3: b = 1; break;

if (isFunctionOrBreakPattern(tok2)) {

varsWithBitsSet.clear();

bitOperations.clear();

}

}

}

}

void CheckOther::redundantBitwiseOperationInSwitchError(const Token *tok, const std::string &varname)

{

reportError(tok, Severity::style,

"redundantBitwiseOperationInSwitch",

"$symbol:" + varname + "\n"

"Redundant bitwise operation on '$symbol' in 'switch' statement. 'break;' missing?");

}

//---------------------------------------------------------------------------

// Check for statements like case A||B: in switch()

//---------------------------------------------------------------------------

void CheckOther::checkSuspiciousCaseInSwitch()

{

if (!mSettings->certainty.isEnabled(Certainty::inconclusive) || !mSettings->severity.isEnabled(Severity::warning))

return;

const SymbolDatabase *symbolDatabase = mTokenizer->getSymbolDatabase();

for (const Scope & scope : symbolDatabase->scopeList) {

if (scope.type != Scope::eSwitch)

continue;

for (const Token* tok = scope.bodyStart->next(); tok != scope.bodyEnd; tok = tok->next()) {

if (tok->str() == "case") {

const Token* finding = nullptr;

for (const Token* tok2 = tok->next(); tok2; tok2 = tok2->next()) {

if (tok2->str() == ":")

break;

if (Token::Match(tok2, "[;}{]"))

break;

if (tok2->str() == "?")

finding = nullptr;

else if (Token::Match(tok2, "&&|%oror%"))

finding = tok2;

}

if (finding)

suspiciousCaseInSwitchError(finding, finding->str());

}

}

}

}

void CheckOther::suspiciousCaseInSwitchError(const Token* tok, const std::string& operatorString)

{

reportError(tok, Severity::warning, "suspiciousCase",

"Found suspicious case label in switch(). Operator '" + operatorString + "' probably doesn't work as intended.\n"

"Using an operator like '" + operatorString + "' in a case label is suspicious. Did you intend to use a bitwise operator, multiple case labels or if/else instead?", CWE398, Certainty::inconclusive);

}

//---------------------------------------------------------------------------

// Find consecutive return, break, continue, goto or throw statements. e.g.:

// break; break;

// Detect dead code, that follows such a statement. e.g.:

// return(0); foo();

//---------------------------------------------------------------------------

void CheckOther::checkUnreachableCode()

{

if (!mSettings->severity.isEnabled(Severity::style))

return;

const bool printInconclusive = mSettings->certainty.isEnabled(Certainty::inconclusive);

const SymbolDatabase* symbolDatabase = mTokenizer->getSymbolDatabase();

for (const Scope * scope : symbolDatabase->functionScopes) {

for (const Token* tok = scope->bodyStart; tok && tok != scope->bodyEnd; tok = tok->next()) {

const Token* secondBreak = nullptr;

const Token* labelName = nullptr;

if (tok->link() && Token::Match(tok, "(|[|<"))

tok = tok->link();

else if (Token::Match(tok, "break|continue ;"))

secondBreak = tok->tokAt(2);

else if (Token::Match(tok, "[;{}:] return|throw")) {

if (Token::simpleMatch(tok->astParent(), "?"))

continue;

tok = tok->next(); // tok should point to return or throw

for (const Token *tok2 = tok->next(); tok2; tok2 = tok2->next()) {

if (tok2->str() == "(" || tok2->str() == "{")

tok2 = tok2->link();

if (tok2->str() == ";") {

secondBreak = tok2->next();

break;

}

}

} else if (Token::Match(tok, "goto %any% ;")) {

secondBreak = tok->tokAt(3);

labelName = tok->next();

} else if (Token::Match(tok, "%name% (") && mSettings->library.isnoreturn(tok) && !Token::Match(tok->next()->astParent(), "?|:")) {

if ((!tok->function() || (tok->function()->token != tok && tok->function()->tokenDef != tok)) && tok->linkAt(1)->strAt(1) != "{")

secondBreak = tok->linkAt(1)->tokAt(2);

}

// Statements follow directly, no line between them. (#3383)

// TODO: Try to find a better way to avoid false positives due to preprocessor configurations.

const bool inconclusive = secondBreak && (secondBreak->linenr() - 1 > secondBreak->previous()->linenr());

if (secondBreak && (printInconclusive || !inconclusive)) {

if (Token::Match(secondBreak, "continue|goto|throw") ||

(secondBreak->str() == "return" && (tok->str() == "return" || secondBreak->strAt(1) == ";"))) { // return with value after statements like throw can be necessary to make a function compile

duplicateBreakError(secondBreak, inconclusive);

tok = Token::findmatch(secondBreak, "[}:]");

} else if (secondBreak->str() == "break") { // break inside switch as second break statement should not issue a warning

if (tok->str() == "break") // If the previous was a break, too: Issue warning

duplicateBreakError(secondBreak, inconclusive);

else {

if (tok->scope()->type != Scope::eSwitch) // Check, if the enclosing scope is a switch

duplicateBreakError(secondBreak, inconclusive);

}

tok = Token::findmatch(secondBreak, "[}:]");

} else if (!Token::Match(secondBreak, "return|}|case|default") && secondBreak->strAt(1) != ":") { // TODO: No bailout for unconditional scopes

// If the goto label is followed by a loop construct in which the label is defined it's quite likely

// that the goto jump was intended to skip some code on the first loop iteration.

bool labelInFollowingLoop = false;

if (labelName && Token::Match(secondBreak, "while|do|for")) {

const Token *scope2 = Token::findsimplematch(secondBreak, "{");

if (scope2) {

for (const Token *tokIter = scope2; tokIter != scope2->link() && tokIter; tokIter = tokIter->next()) {

if (Token::Match(tokIter, "[;{}] %any% :") && labelName->str() == tokIter->strAt(1)) {

labelInFollowingLoop = true;

break;

}

}

}

}

// hide FP for statements that just hide compiler warnings about unused function arguments

bool silencedCompilerWarningOnly = false;

const Token *silencedWarning = secondBreak;

for (;;) {

if (Token::Match(silencedWarning, "( void ) %name% ;")) {

silencedWarning = silencedWarning->tokAt(5);

continue;

} else if (silencedWarning && silencedWarning == scope->bodyEnd)

silencedCompilerWarningOnly = true;

break;

}

if (silencedWarning)

secondBreak = silencedWarning;

if (!labelInFollowingLoop && !silencedCompilerWarningOnly)

unreachableCodeError(secondBreak, inconclusive);

tok = Token::findmatch(secondBreak, "[}:]");

} else

tok = secondBreak;

if (!tok)

break;

tok = tok->previous(); // Will be advanced again by for loop

}

}

}

}

void CheckOther::duplicateBreakError(const Token *tok, bool inconclusive)

{

reportError(tok, Severity::style, "duplicateBreak",

"Consecutive return, break, continue, goto or throw statements are unnecessary.\n"

"Consecutive return, break, continue, goto or throw statements are unnecessary. "

"The second statement can never be executed, and so should be removed.", CWE561, inconclusive ? Certainty::inconclusive : Certainty::normal);

}

void CheckOther::unreachableCodeError(const Token *tok, bool inconclusive)

{

reportError(tok, Severity::style, "unreachableCode",

"Statements following return, break, continue, goto or throw will never be executed.", CWE561, inconclusive ? Certainty::inconclusive : Certainty::normal);

}

//---------------------------------------------------------------------------

// Check scope of variables..

//---------------------------------------------------------------------------

void CheckOther::checkVariableScope()

{

if (mSettings->clang)

return;

if (!mSettings->severity.isEnabled(Severity::style))

return;

const SymbolDatabase *symbolDatabase = mTokenizer->getSymbolDatabase();

// In C it is common practice to declare local variables at the

// start of functions.

if (mSettings->daca && mTokenizer->isC())

return;

for (const Variable* var : symbolDatabase->variableList()) {

if (!var || !var->isLocal() || (!var->isPointer() && !var->isReference() && !var->typeStartToken()->isStandardType()))

continue;

if (var->isConst())

continue;

if (mTokenizer->hasIfdef(var->nameToken(), var->scope()->bodyEnd))

continue;

// reference of range for loop variable..

if (Token::Match(var->nameToken()->previous(), "& %var% = %var% .")) {

const Token *otherVarToken = var->nameToken()->tokAt(2);

const Variable *otherVar = otherVarToken->variable();

if (otherVar && Token::Match(otherVar->nameToken(), "%var% :") &&

otherVar->nameToken()->next()->astParent() &&

Token::simpleMatch(otherVar->nameToken()->next()->astParent()->previous(), "for ("))

continue;

}

bool forHead = false; // Don't check variables declared in header of a for loop

for (const Token* tok = var->typeStartToken(); tok; tok = tok->previous()) {

if (tok->str() == "(") {

forHead = true;

break;

} else if (Token::Match(tok, "[;{}]"))

break;

}

if (forHead)

continue;

const Token* tok = var->nameToken()->next();

if (Token::Match(tok, "; %varid% = %any% ;", var->declarationId())) {

tok = tok->tokAt(3);

if (!tok->isNumber() && tok->tokType() != Token::eString && tok->tokType() != Token::eChar && !tok->isBoolean())

continue;

}

// bailout if initialized with function call that has possible side effects

if (Token::Match(tok, "[(=]") && Token::simpleMatch(tok->astOperand2(), "("))

continue;

bool reduce = true;

bool used = false; // Don't warn about unused variables

for (; tok && tok != var->scope()->bodyEnd; tok = tok->next()) {

if (tok->str() == "{" && tok->scope() != tok->previous()->scope() && !tok->isExpandedMacro() && tok->scope()->type != Scope::eLambda) {

if (used) {

bool used2 = false;

if (!checkInnerScope(tok, var, used2) || used2) {

reduce = false;

break;

}

} else if (!checkInnerScope(tok, var, used)) {

reduce = false;

break;

}

tok = tok->link();

// parse else if blocks..

} else if (Token::simpleMatch(tok, "else { if (") && Token::simpleMatch(tok->linkAt(3), ") {")) {

const Token *endif = tok->linkAt(3)->linkAt(1);

bool elseif = false;

if (Token::simpleMatch(endif, "} }"))

elseif = true;

else if (Token::simpleMatch(endif, "} else {") && Token::simpleMatch(endif->linkAt(2),"} }"))

elseif = true;

if (elseif && Token::findmatch(tok->next(), "%varid%", tok->linkAt(1), var->declarationId())) {

reduce = false;

break;

}

} else if (tok->varId() == var->declarationId() || tok->str() == "goto") {

reduce = false;

break;

}

}

if (reduce && used)

variableScopeError(var->nameToken(), var->name());

}

}

bool CheckOther::checkInnerScope(const Token *tok, const Variable* var, bool& used)

{

const Scope* scope = tok->next()->scope();

bool loopVariable = scope->isLoopScope();

bool noContinue = true;

const Token* forHeadEnd = nullptr;

const Token* end = tok->link();

if (scope->type == Scope::eUnconditional && (tok->strAt(-1) == ")" || tok->previous()->isName())) // Might be an unknown macro like BOOST_FOREACH

loopVariable = true;

if (scope->type == Scope::eDo) {

end = end->linkAt(2);

} else if (loopVariable && tok->strAt(-1) == ")") {

tok = tok->linkAt(-1); // Jump to opening ( of for/while statement

} else if (scope->type == Scope::eSwitch) {

for (const Scope* innerScope : scope->nestedList) {

if (used) {

bool used2 = false;

if (!checkInnerScope(innerScope->bodyStart, var, used2) || used2) {

return false;