/*

* Cppcheck - A tool for static C/C++ code analysis

* Copyright (C) 2007-2021 Cppcheck team.

*

* This program is free software: you can redistribute it and/or modify

* it under the terms of the GNU General Public License as published by

* the Free Software Foundation, either version 3 of the License, or

* (at your option) any later version.

*

* This program is distributed in the hope that it will be useful,

* but WITHOUT ANY WARRANTY; without even the implied warranty of

* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

* GNU General Public License for more details.

*

* You should have received a copy of the GNU General Public License

* along with this program. If not, see <http://www.gnu.org/licenses/>.

*/

/**

* @brief This is the ValueFlow component in Cppcheck.

*

* Each @sa Token in the token list has a list of values. These are

* the "possible" values for the Token at runtime.

*

* In the --debug and --debug-normal output you can see the ValueFlow data. For example:

*

* int f()

* {

* int x = 10;

* return 4 * x + 2;

* }

*

* The --debug-normal output says:

*

* ##Value flow

* Line 3

* 10 always 10

* Line 4

* 4 always 4

* * always 40

* x always 10

* + always 42

* 2 always 2

*

* All value flow analysis is executed in the ValueFlow::setValues() function. The ValueFlow analysis is executed after

* the tokenizer/ast/symboldatabase/etc.. The ValueFlow analysis is done in a series of valueFlow* function calls, where

* each such function call can only use results from previous function calls. The function calls should be arranged so

* that valueFlow* that do not require previous ValueFlow information should be first.

*

* Type of analysis

* ================

*

* This is "flow sensitive" value flow analysis. We _usually_ track the value for 1 variable at a time.

*

* How are calculations handled

* ============================

*

* Here is an example code:

*

* x = 3 + 4;

*

* The valueFlowNumber set the values for the "3" and "4" tokens by calling setTokenValue().

* The setTokenValue() handle the calculations automatically. When both "3" and "4" have values, the "+" can be

* calculated. setTokenValue() recursively calls itself when parents in calculations can be calculated.

*

* Forward / Reverse flow analysis

* ===============================

*

* In forward value flow analysis we know a value and see what happens when we are stepping the program forward. Like

* normal execution. The valueFlowForwardVariable is used in this analysis.

*

* In reverse value flow analysis we know the value of a variable at line X. And try to "execute backwards" to determine

* possible values before line X. The valueFlowReverse is used in this analysis.

*

*

*/

#include "valueflow.h"

#include "analyzer.h"

#include "astutils.h"

#include "errorlogger.h"

#include "errortypes.h"

#include "forwardanalyzer.h"

#include "library.h"

#include "mathlib.h"

#include "path.h"

#include "platform.h"

#include "programmemory.h"

#include "reverseanalyzer.h"

#include "settings.h"

#include "standards.h"

#include "symboldatabase.h"

#include "token.h"

#include "tokenlist.h"

#include "utils.h"

#include "valueptr.h"

#include <algorithm>

#include <cassert>

#include <cstddef>

#include <cstdint>

#include <cstring>

#include <functional>

#include <iterator>

#include <limits>

#include <map>

#include <set>

#include <stack>

#include <stdexcept>

#include <string>

#include <tuple>

#include <vector>

static void bailoutInternal(const std::string& type, TokenList *tokenlist, ErrorLogger *errorLogger, const Token *tok, const std::string &what, const std::string &file, int line, std::string function)

{

if (function.find("operator") != std::string::npos)

function = "(valueFlow)";

std::list<ErrorMessage::FileLocation> callstack(1, ErrorMessage::FileLocation(tok, tokenlist));

ErrorMessage errmsg(callstack, tokenlist->getSourceFilePath(), Severity::debug,

Path::stripDirectoryPart(file) + ":" + MathLib::toString(line) + ":" + function + " bailout: " + what, type, Certainty::normal);

errorLogger->reportErr(errmsg);

}

#if (defined __cplusplus) && __cplusplus >= 201103L

#define bailout2(type, tokenlist, errorLogger, tok, what) bailoutInternal(type, tokenlist, errorLogger, tok, what, __FILE__, __LINE__, __func__)

#elif (defined __GNUC__) || (defined __clang__) || (defined _MSC_VER)

#define bailout2(type, tokenlist, errorLogger, tok, what) bailoutInternal(type, tokenlist, errorLogger, tok, what, __FILE__, __LINE__, __FUNCTION__)

#else

#define bailout2(type, tokenlist, errorLogger, tok, what) bailoutInternal(type, tokenlist, errorLogger, tok, what, __FILE__, __LINE__, "(valueFlow)")

#endif

#define bailout(tokenlist, errorLogger, tok, what) bailout2("valueFlowBailout", tokenlist, errorLogger, tok, what)

#define bailoutIncompleteVar(tokenlist, errorLogger, tok, what) bailout2("valueFlowBailoutIncompleteVar", tokenlist, errorLogger, tok, what)

static void changeKnownToPossible(std::list<ValueFlow::Value> &values, int indirect=-1)

{

for (ValueFlow::Value& v: values) {

if (indirect >= 0 && v.indirect != indirect)

continue;

v.changeKnownToPossible();

}

}

static void removeImpossible(std::list<ValueFlow::Value>& values, int indirect = -1)

{

values.remove_if([&](const ValueFlow::Value& v) {

if (indirect >= 0 && v.indirect != indirect)

return false;

return v.isImpossible();

});

}

static void lowerToPossible(std::list<ValueFlow::Value>& values, int indirect = -1)

{

changeKnownToPossible(values, indirect);

removeImpossible(values, indirect);

}

static void changePossibleToKnown(std::list<ValueFlow::Value>& values, int indirect = -1)

{

for (ValueFlow::Value& v : values) {

if (indirect >= 0 && v.indirect != indirect)

continue;

if (!v.isPossible())

continue;

if (v.bound != ValueFlow::Value::Bound::Point)

continue;

v.setKnown();

}

}

static void setValueUpperBound(ValueFlow::Value& value, bool upper)

{

if (upper)

value.bound = ValueFlow::Value::Bound::Upper;

else

value.bound = ValueFlow::Value::Bound::Lower;

}

static void setValueBound(ValueFlow::Value& value, const Token* tok, bool invert)

{

if (Token::Match(tok, "<|<=")) {

setValueUpperBound(value, !invert);

} else if (Token::Match(tok, ">|>=")) {

setValueUpperBound(value, invert);

}

}

static void setConditionalValues(const Token *tok,

bool invert,

MathLib::bigint value,

ValueFlow::Value &true_value,

ValueFlow::Value &false_value)

{

if (Token::Match(tok, "==|!=|>=|<=")) {

true_value = ValueFlow::Value{tok, value};

const char* greaterThan = ">=";

const char* lessThan = "<=";

if (invert)

std::swap(greaterThan, lessThan);

if (Token::simpleMatch(tok, greaterThan, strlen(greaterThan))) {

false_value = ValueFlow::Value{tok, value - 1};

} else if (Token::simpleMatch(tok, lessThan, strlen(lessThan))) {

false_value = ValueFlow::Value{tok, value + 1};

} else {

false_value = ValueFlow::Value{tok, value};

}

} else {

const char* greaterThan = ">";

const char* lessThan = "<";

if (invert)

std::swap(greaterThan, lessThan);

if (Token::simpleMatch(tok, greaterThan, strlen(greaterThan))) {

true_value = ValueFlow::Value{tok, value + 1};

false_value = ValueFlow::Value{tok, value};

} else if (Token::simpleMatch(tok, lessThan, strlen(lessThan))) {

true_value = ValueFlow::Value{tok, value - 1};

false_value = ValueFlow::Value{tok, value};

}

}

setValueBound(true_value, tok, invert);

setValueBound(false_value, tok, !invert);

}

static bool isSaturated(MathLib::bigint value)

{

return value == std::numeric_limits<MathLib::bigint>::max() || value == std::numeric_limits<MathLib::bigint>::min();

}

const Token *parseCompareInt(const Token *tok, ValueFlow::Value &true_value, ValueFlow::Value &false_value, const std::function<std::vector<MathLib::bigint>(const Token*)>& evaluate)

{

if (!tok->astOperand1() || !tok->astOperand2())

return nullptr;

if (tok->isComparisonOp()) {

std::vector<MathLib::bigint> value1 = evaluate(tok->astOperand1());

std::vector<MathLib::bigint> value2 = evaluate(tok->astOperand2());

if (!value1.empty()) {

if (isSaturated(value1.front()))

return nullptr;

setConditionalValues(tok, true, value1.front(), true_value, false_value);

return tok->astOperand2();

} else if (!value2.empty()) {

if (isSaturated(value2.front()))

return nullptr;

setConditionalValues(tok, false, value2.front(), true_value, false_value);

return tok->astOperand1();

}

}

return nullptr;

}

const Token *parseCompareInt(const Token *tok, ValueFlow::Value &true_value, ValueFlow::Value &false_value)

{

return parseCompareInt(tok, true_value, false_value, [](const Token* t) -> std::vector<MathLib::bigint> {

if (t->hasKnownIntValue())

return {t->values().front().intvalue};

return std::vector<MathLib::bigint>{};

});

}

static bool isEscapeScope(const Token* tok, TokenList * tokenlist, bool unknown = false)

{

if (!Token::simpleMatch(tok, "{"))

return false;

// TODO this search for termTok in all subscopes. It should check the end of the scope.

const Token * termTok = Token::findmatch(tok, "return|continue|break|throw|goto", tok->link());

if (termTok && termTok->scope() == tok->scope())

return true;

std::string unknownFunction;

if (tokenlist && tokenlist->getSettings()->library.isScopeNoReturn(tok->link(), &unknownFunction))

return unknownFunction.empty() || unknown;

return false;

}

static ValueFlow::Value castValue(ValueFlow::Value value, const ValueType::Sign sign, nonneg int bit)

{

if (value.isFloatValue()) {

value.valueType = ValueFlow::Value::ValueType::INT;

if (value.floatValue >= std::numeric_limits<int>::min() && value.floatValue <= std::numeric_limits<int>::max()) {

value.intvalue = value.floatValue;

} else { // don't perform UB

value.intvalue = 0;

}

}

if (bit < MathLib::bigint_bits) {

const MathLib::biguint one = 1;

value.intvalue &= (one << bit) - 1;

if (sign == ValueType::Sign::SIGNED && value.intvalue & (one << (bit - 1))) {

value.intvalue |= ~((one << bit) - 1ULL);

}

}

return value;

}

static void combineValueProperties(const ValueFlow::Value &value1, const ValueFlow::Value &value2, ValueFlow::Value *result)

{

if (value1.isKnown() && value2.isKnown())

result->setKnown();

else if (value1.isImpossible() || value2.isImpossible())

result->setImpossible();

else if (value1.isInconclusive() || value2.isInconclusive())

result->setInconclusive();

else

result->setPossible();

if (value1.isIteratorValue())

result->valueType = value1.valueType;

if (value2.isIteratorValue())

result->valueType = value2.valueType;

result->condition = value1.condition ? value1.condition : value2.condition;

result->varId = (value1.varId != 0) ? value1.varId : value2.varId;

result->varvalue = (result->varId == value1.varId) ? value1.varvalue : value2.varvalue;

result->errorPath = (value1.errorPath.empty() ? value2 : value1).errorPath;

result->safe = value1.safe || value2.safe;

if (value1.bound == ValueFlow::Value::Bound::Point || value2.bound == ValueFlow::Value::Bound::Point) {

if (value1.bound == ValueFlow::Value::Bound::Upper || value2.bound == ValueFlow::Value::Bound::Upper)

result->bound = ValueFlow::Value::Bound::Upper;

if (value1.bound == ValueFlow::Value::Bound::Lower || value2.bound == ValueFlow::Value::Bound::Lower)

result->bound = ValueFlow::Value::Bound::Lower;

}

if (value1.path != value2.path)

result->path = -1;

else

result->path = value1.path;

}

static const Token *getCastTypeStartToken(const Token *parent)

{

// TODO: This might be a generic utility function?

if (!parent || parent->str() != "(")

return nullptr;

if (!parent->astOperand2() && Token::Match(parent,"( %name%"))

return parent->next();

if (parent->astOperand2() && Token::Match(parent->astOperand1(), "const_cast|dynamic_cast|reinterpret_cast|static_cast <"))

return parent->astOperand1()->tokAt(2);

return nullptr;

}

static bool isComputableValue(const Token* parent, const ValueFlow::Value& value)

{

const bool noninvertible = parent->isComparisonOp() || Token::Match(parent, "%|/|&|%or%");

if (noninvertible && value.isImpossible())

return false;

if (!value.isIntValue() && !value.isFloatValue() && !value.isTokValue() && !value.isIteratorValue())

return false;

if (value.isIteratorValue() && !Token::Match(parent, "+|-"))

return false;

if (value.isTokValue() && (!parent->isComparisonOp() || value.tokvalue->tokType() != Token::eString))

return false;

return true;

}

template<class T>

static bool isEqual(T x, T y)

{

return x == y;

}

template<>

bool isEqual<double>(double x, double y)

{

const double diff = (x > y) ? x - y : y - x;

return !((diff / 2) < diff);

}

template<class T>

static bool isZero(T x)

{

return isEqual<T>(x, T(0));

}

template <class T>

static T calculate(const std::string& s, T x, T y)

{

switch (MathLib::encodeMultiChar(s)) {

case '+':

return x + y;

case '-':

return x - y;

case '*':

return x * y;

case '/':

return x / y;

case '%':

return MathLib::bigint(x) % MathLib::bigint(y);

case '&':

return MathLib::bigint(x) & MathLib::bigint(y);

case '|':

return MathLib::bigint(x) | MathLib::bigint(y);

case '^':

return MathLib::bigint(x) ^ MathLib::bigint(y);

case '>':

return x > y;

case '<':

return x < y;

case '<<':

return MathLib::bigint(x) << MathLib::bigint(y);

case '>>':

return MathLib::bigint(x) >> MathLib::bigint(y);

case '&&':

return !isZero(x) && !isZero(y);

case '||':

return !isZero(x) || !isZero(y);

case '==':

return isEqual(x, y);

case '!=':

return !isEqual(x, y);

case '>=':

return x >= y;

case '<=':

return x <= y;

}

throw InternalError(nullptr, "Unknown operator: " + s);

}

/** Set token value for cast */

static void setTokenValueCast(Token *parent, const ValueType &valueType, const ValueFlow::Value &value, const Settings *settings);

/** set ValueFlow value and perform calculations if possible */

static void setTokenValue(Token* tok, const ValueFlow::Value &value, const Settings *settings)

{

if (!tok->addValue(value))

return;

if (value.path < 0)

return;

Token *parent = tok->astParent();

if (!parent)

return;

if (Token::simpleMatch(parent, "=") && astIsRHS(tok) && !value.isLifetimeValue()) {

setTokenValue(parent, value, settings);

return;

}

if (value.isContainerSizeValue()) {

// .empty, .size, +"abc", +'a'

if (Token::Match(parent, "+|==|!=") && parent->astOperand1() && parent->astOperand2()) {

for (const ValueFlow::Value &value1 : parent->astOperand1()->values()) {

if (value1.isImpossible())

continue;

for (const ValueFlow::Value &value2 : parent->astOperand2()->values()) {

if (value2.isImpossible())

continue;

if (value1.path != value2.path)

continue;

ValueFlow::Value result;

if (Token::Match(parent, "%comp%"))

result.valueType = ValueFlow::Value::ValueType::INT;

else

result.valueType = ValueFlow::Value::ValueType::CONTAINER_SIZE;

if (value1.isContainerSizeValue() && value2.isContainerSizeValue())

result.intvalue = calculate(parent->str(), value1.intvalue, value2.intvalue);

else if (value1.isContainerSizeValue() && value2.isTokValue() && value2.tokvalue->tokType() == Token::eString)

result.intvalue = calculate(parent->str(), value1.intvalue, MathLib::bigint(Token::getStrLength(value2.tokvalue)));

else if (value2.isContainerSizeValue() && value1.isTokValue() && value1.tokvalue->tokType() == Token::eString)

result.intvalue = calculate(parent->str(), MathLib::bigint(Token::getStrLength(value1.tokvalue)), value2.intvalue);

else

continue;

combineValueProperties(value1, value2, &result);

if (Token::simpleMatch(parent, "==") && result.intvalue)

continue;

if (Token::simpleMatch(parent, "!=") && !result.intvalue)

continue;

setTokenValue(parent, result, settings);

}

}

}

else if (Token::Match(parent, ". %name% (") && parent->astParent() == parent->tokAt(2) &&

parent->astOperand1() && parent->astOperand1()->valueType()) {

const Library::Container *c = parent->astOperand1()->valueType()->container;

const Library::Container::Yield yields = c ? c->getYield(parent->strAt(1)) : Library::Container::Yield::NO_YIELD;

if (yields == Library::Container::Yield::SIZE) {

ValueFlow::Value v(value);

v.valueType = ValueFlow::Value::ValueType::INT;

setTokenValue(parent->astParent(), v, settings);

} else if (yields == Library::Container::Yield::EMPTY) {

ValueFlow::Value v(value);

v.intvalue = !v.intvalue;

v.valueType = ValueFlow::Value::ValueType::INT;

setTokenValue(parent->astParent(), v, settings);

}

}

return;

}

if (value.isLifetimeValue()) {

if (!isLifetimeBorrowed(parent, settings))

return;

if (value.lifetimeKind == ValueFlow::Value::LifetimeKind::Iterator && astIsIterator(parent)) {

setTokenValue(parent,value,settings);

} else if (astIsPointer(tok) && astIsPointer(parent) &&

(parent->isArithmeticalOp() || Token::Match(parent, "( %type%"))) {

setTokenValue(parent,value,settings);

}

return;

}

if (value.isUninitValue()) {

ValueFlow::Value pvalue = value;

if (parent->isUnaryOp("&")) {

pvalue.indirect++;

setTokenValue(parent, pvalue, settings);

} else if (Token::Match(parent, ". %var%") && parent->astOperand1() == tok) {

if (parent->originalName() == "->" && pvalue.indirect > 0)

pvalue.indirect--;

setTokenValue(parent->astOperand2(), pvalue, settings);

} else if (Token::Match(parent->astParent(), ". %var%") && parent->astParent()->astOperand1() == parent) {

if (parent->astParent()->originalName() == "->" && pvalue.indirect > 0)

pvalue.indirect--;

setTokenValue(parent->astParent()->astOperand2(), pvalue, settings);

} else if (parent->isUnaryOp("*") && pvalue.indirect > 0) {

pvalue.indirect--;

setTokenValue(parent, pvalue, settings);

}

return;

}

// cast..

if (const Token *castType = getCastTypeStartToken(parent)) {

if (((tok->valueType() == nullptr && value.isImpossible()) || astIsPointer(tok)) && value.valueType == ValueFlow::Value::ValueType::INT &&

Token::simpleMatch(parent->astOperand1(), "dynamic_cast"))

return;

const ValueType &valueType = ValueType::parseDecl(castType, settings);

setTokenValueCast(parent, valueType, value, settings);

}

else if (parent->str() == ":") {

setTokenValue(parent,value,settings);

}

else if (parent->str() == "?" && tok->str() == ":" && tok == parent->astOperand2() && parent->astOperand1()) {

// is condition always true/false?

if (parent->astOperand1()->hasKnownValue()) {

const ValueFlow::Value &condvalue = parent->astOperand1()->values().front();

const bool cond(condvalue.isTokValue() || (condvalue.isIntValue() && condvalue.intvalue != 0));

if (cond && !tok->astOperand1()) { // true condition, no second operator

setTokenValue(parent, condvalue, settings);

} else {

const Token *op = cond ? tok->astOperand1() : tok->astOperand2();

if (!op) // #7769 segmentation fault at setTokenValue()

return;

const std::list<ValueFlow::Value> &values = op->values();

if (std::find(values.begin(), values.end(), value) != values.end())

setTokenValue(parent, value, settings);

}

} else {

// is condition only depending on 1 variable?

nonneg int varId = 0;

bool ret = false;

visitAstNodes(parent->astOperand1(),

[&](const Token *t) {

if (t->varId()) {

if (varId > 0 || value.varId != 0)

ret = true;

varId = t->varId();

} else if (t->str() == "(" && Token::Match(t->previous(), "%name%"))

ret = true; // function call

return ret ? ChildrenToVisit::done : ChildrenToVisit::op1_and_op2;

});

if (ret)

return;

ValueFlow::Value v(value);

v.conditional = true;

v.changeKnownToPossible();

if (varId)

v.varId = varId;

setTokenValue(parent, v, settings);

}

}

else if (parent->str() == "?" && value.isIntValue() && tok == parent->astOperand1() && value.isKnown() &&

parent->astOperand2() && parent->astOperand2()->astOperand1() && parent->astOperand2()->astOperand2()) {

const std::list<ValueFlow::Value> &values = (value.intvalue == 0

? parent->astOperand2()->astOperand2()->values()

: parent->astOperand2()->astOperand1()->values());

for (const ValueFlow::Value &v : values)

setTokenValue(parent, v, settings);

}

// Calculations..

else if ((parent->isArithmeticalOp() || parent->isComparisonOp() || (parent->tokType() == Token::eBitOp) || (parent->tokType() == Token::eLogicalOp)) &&

parent->astOperand1() &&

parent->astOperand2()) {

const bool noninvertible = parent->isComparisonOp() || Token::Match(parent, "%|/|&|%or%");

// Skip operators with impossible values that are not invertible

if (noninvertible && value.isImpossible())

return;

// known result when a operand is 0.

if (Token::Match(parent, "[&*]") && value.isKnown() && value.isIntValue() && value.intvalue==0) {

setTokenValue(parent, value, settings);

return;

}

// known result when a operand is true.

if (Token::simpleMatch(parent, "&&") && value.isKnown() && value.isIntValue() && value.intvalue==0) {

setTokenValue(parent, value, settings);

return;

}

// known result when a operand is false.

if (Token::simpleMatch(parent, "||") && value.isKnown() && value.isIntValue() && value.intvalue!=0) {

setTokenValue(parent, value, settings);

return;

}

for (const ValueFlow::Value &value1 : parent->astOperand1()->values()) {

if (!isComputableValue(parent, value1))

continue;

for (const ValueFlow::Value &value2 : parent->astOperand2()->values()) {

if (value1.path != value2.path)

continue;

if (!isComputableValue(parent, value2))

continue;

if (value1.isIteratorValue() && value2.isIteratorValue())

continue;

if (value1.isKnown() || value2.isKnown() || value1.varId == 0 || value2.varId == 0 ||

(value1.varId == value2.varId && value1.varvalue == value2.varvalue && value1.isIntValue() &&

value2.isIntValue())) {

ValueFlow::Value result(0);

combineValueProperties(value1, value2, &result);

const double floatValue1 = value1.isIntValue() ? value1.intvalue : value1.floatValue;

const double floatValue2 = value2.isIntValue() ? value2.intvalue : value2.floatValue;

const bool isFloat = value1.isFloatValue() || value2.isFloatValue();

if (isFloat && Token::Match(parent, "&|^|%|<<|>>|%or%"))

continue;

if (Token::Match(parent, "<<|>>") &&

!(value1.intvalue >= 0 && value2.intvalue >= 0 && value2.intvalue < MathLib::bigint_bits))

continue;

if (Token::Match(parent, "/|%") && isZero<double>(floatValue2))

continue;

if (Token::Match(parent, "==|!=")) {

if ((value1.isIntValue() && value2.isTokValue()) || (value1.isTokValue() && value2.isIntValue())) {

if (parent->str() == "==")

result.intvalue = 0;

else if (parent->str() == "!=")

result.intvalue = 1;

} else if (value1.isIntValue() && value2.isIntValue()) {

result.intvalue = calculate(parent->str(), value1.intvalue, value2.intvalue);

} else {

continue;

}

setTokenValue(parent, result, settings);

} else if (Token::Match(parent, "%comp%")) {

if (!isFloat && !value1.isIntValue() && !value2.isIntValue())

continue;

if (isFloat)

result.intvalue = calculate(parent->str(), floatValue1, floatValue2);

else

result.intvalue = calculate(parent->str(), value1.intvalue, value2.intvalue);

setTokenValue(parent, result, settings);

} else if (Token::Match(parent, "%op%")) {

if (value1.isTokValue() || value2.isTokValue())

break;

if (isFloat) {

result.valueType = ValueFlow::Value::ValueType::FLOAT;

result.floatValue = calculate(parent->str(), floatValue1, floatValue2);

} else {

result.intvalue = calculate(parent->str(), value1.intvalue, value2.intvalue);

}

// If the bound comes from the second value then invert the bound when subtracting

if (Token::simpleMatch(parent, "-") && value2.bound == result.bound &&

value2.bound != ValueFlow::Value::Bound::Point)

result.invertBound();

setTokenValue(parent, result, settings);

}

}

}

}

}

// !

else if (parent->str() == "!") {

for (const ValueFlow::Value &val : tok->values()) {

if (!val.isIntValue())

continue;

ValueFlow::Value v(val);

v.intvalue = !v.intvalue;

setTokenValue(parent, v, settings);

}

}

// ~

else if (parent->str() == "~") {

for (const ValueFlow::Value &val : tok->values()) {

if (!val.isIntValue())

continue;

ValueFlow::Value v(val);

v.intvalue = ~v.intvalue;

int bits = 0;

if (settings &&

tok->valueType() &&

tok->valueType()->sign == ValueType::Sign::UNSIGNED &&

tok->valueType()->pointer == 0) {

if (tok->valueType()->type == ValueType::Type::INT)

bits = settings->int_bit;

else if (tok->valueType()->type == ValueType::Type::LONG)

bits = settings->long_bit;

}

if (bits > 0 && bits < MathLib::bigint_bits)

v.intvalue &= (((MathLib::biguint)1)<<bits) - 1;

setTokenValue(parent, v, settings);

}

}

// unary minus

else if (parent->isUnaryOp("-")) {

for (const ValueFlow::Value &val : tok->values()) {

if (!val.isIntValue() && !val.isFloatValue())

continue;

ValueFlow::Value v(val);

if (v.isIntValue()) {

if (v.intvalue == LLONG_MIN)

// Value can't be inverted

continue;

v.intvalue = -v.intvalue;

} else

v.floatValue = -v.floatValue;

v.invertBound();

setTokenValue(parent, v, settings);

}

}

// increment

else if (parent->str() == "++") {

for (const ValueFlow::Value &val : tok->values()) {

if (!val.isIntValue() && !val.isFloatValue())

continue;

ValueFlow::Value v(val);

if (parent == tok->previous()) {

if (v.isIntValue())

v.intvalue = v.intvalue + 1;

else

v.floatValue = v.floatValue + 1.0;

}

setTokenValue(parent, v, settings);

}

}

// decrement

else if (parent->str() == "--") {

for (const ValueFlow::Value &val : tok->values()) {

if (!val.isIntValue() && !val.isFloatValue())

continue;

ValueFlow::Value v(val);

if (parent == tok->previous()) {

if (v.isIntValue())

v.intvalue = v.intvalue - 1;

else

v.floatValue = v.floatValue - 1.0;

}

setTokenValue(parent, v, settings);

}

}

// Array element

else if (parent->str() == "[" && parent->isBinaryOp()) {

for (const ValueFlow::Value &value1 : parent->astOperand1()->values()) {

if (!value1.isTokValue())

continue;

for (const ValueFlow::Value &value2 : parent->astOperand2()->values()) {

if (!value2.isIntValue())

continue;

if (value1.varId == 0 || value2.varId == 0 ||

(value1.varId == value2.varId && value1.varvalue == value2.varvalue)) {

ValueFlow::Value result(0);

result.condition = value1.condition ? value1.condition : value2.condition;

result.setInconclusive(value1.isInconclusive() | value2.isInconclusive());

result.varId = (value1.varId != 0) ? value1.varId : value2.varId;

result.varvalue = (result.varId == value1.varId) ? value1.intvalue : value2.intvalue;

if (value1.valueKind == value2.valueKind)

result.valueKind = value1.valueKind;

if (value1.tokvalue->tokType() == Token::eString) {

const std::string s = value1.tokvalue->strValue();

const MathLib::bigint index = value2.intvalue;

if (index == s.size()) {

result.intvalue = 0;

setTokenValue(parent, result, settings);

} else if (index >= 0 && index < s.size()) {

result.intvalue = s[index];

setTokenValue(parent, result, settings);

}

} else if (value1.tokvalue->str() == "{") {

MathLib::bigint index = value2.intvalue;

const Token *element = value1.tokvalue->next();

while (index > 0 && element->str() != "}") {

if (element->str() == ",")

--index;

if (Token::Match(element, "[{}()[]]"))

break;

element = element->next();

}

if (Token::Match(element, "%num% [,}]")) {

result.intvalue = MathLib::toLongNumber(element->str());

setTokenValue(parent, result, settings);

}

}

}

}

}

}

else if (Token::Match(parent, ":: %name%") && parent->astOperand2() == tok) {

setTokenValue(parent, value, settings);

}

}

static void setTokenValueCast(Token *parent, const ValueType &valueType, const ValueFlow::Value &value, const Settings *settings)

{

if (valueType.pointer)

setTokenValue(parent,value,settings);

else if (valueType.type == ValueType::Type::CHAR)

setTokenValue(parent, castValue(value, valueType.sign, settings->char_bit), settings);

else if (valueType.type == ValueType::Type::SHORT)

setTokenValue(parent, castValue(value, valueType.sign, settings->short_bit), settings);

else if (valueType.type == ValueType::Type::INT)

setTokenValue(parent, castValue(value, valueType.sign, settings->int_bit), settings);

else if (valueType.type == ValueType::Type::LONG)

setTokenValue(parent, castValue(value, valueType.sign, settings->long_bit), settings);

else if (valueType.type == ValueType::Type::LONGLONG)

setTokenValue(parent, castValue(value, valueType.sign, settings->long_long_bit), settings);

else if (value.isIntValue()) {

const long long charMax = settings->signedCharMax();

const long long charMin = settings->signedCharMin();

if (charMin <= value.intvalue && value.intvalue <= charMax) {

// unknown type, but value is small so there should be no truncation etc

setTokenValue(parent,value,settings);

}

}

}

static nonneg int getSizeOfType(const Token *typeTok, const Settings *settings)

{

const ValueType &valueType = ValueType::parseDecl(typeTok, settings);

if (valueType.pointer > 0)

return settings->sizeof_pointer;

if (valueType.type == ValueType::Type::BOOL || valueType.type == ValueType::Type::CHAR)

return 1;

if (valueType.type == ValueType::Type::SHORT)

return settings->sizeof_short;

if (valueType.type == ValueType::Type::INT)

return settings->sizeof_int;

if (valueType.type == ValueType::Type::LONG)

return settings->sizeof_long;

if (valueType.type == ValueType::Type::LONGLONG)

return settings->sizeof_long_long;

if (valueType.type == ValueType::Type::WCHAR_T)

return settings->sizeof_wchar_t;

return 0;

}

size_t ValueFlow::getSizeOf(const ValueType &vt, const Settings *settings)

{

if (vt.pointer)

return settings->sizeof_pointer;

if (vt.type == ValueType::Type::CHAR)

return 1;

if (vt.type == ValueType::Type::SHORT)

return settings->sizeof_short;

if (vt.type == ValueType::Type::WCHAR_T)

return settings->sizeof_wchar_t;

if (vt.type == ValueType::Type::INT)

return settings->sizeof_int;

if (vt.type == ValueType::Type::LONG)

return settings->sizeof_long;

if (vt.type == ValueType::Type::LONGLONG)

return settings->sizeof_long_long;

if (vt.type == ValueType::Type::FLOAT)

return settings->sizeof_float;

if (vt.type == ValueType::Type::DOUBLE)

return settings->sizeof_double;

if (vt.type == ValueType::Type::LONGDOUBLE)

return settings->sizeof_long_double;

return 0;

}

// Handle various constants..

static Token * valueFlowSetConstantValue(Token *tok, const Settings *settings, bool cpp)

{

if ((tok->isNumber() && MathLib::isInt(tok->str())) || (tok->tokType() == Token::eChar)) {

ValueFlow::Value value(MathLib::toLongNumber(tok->str()));

if (!tok->isTemplateArg())

value.setKnown();

setTokenValue(tok, value, settings);

} else if (tok->isNumber() && MathLib::isFloat(tok->str())) {

ValueFlow::Value value;

value.valueType = ValueFlow::Value::ValueType::FLOAT;

value.floatValue = MathLib::toDoubleNumber(tok->str());

if (!tok->isTemplateArg())

value.setKnown();

setTokenValue(tok, value, settings);

} else if (tok->enumerator() && tok->enumerator()->value_known) {

ValueFlow::Value value(tok->enumerator()->value);

if (!tok->isTemplateArg())

value.setKnown();

setTokenValue(tok, value, settings);

} else if (tok->str() == "NULL" || (cpp && tok->str() == "nullptr")) {

ValueFlow::Value value(0);

if (!tok->isTemplateArg())

value.setKnown();

setTokenValue(tok, value, settings);

} else if (Token::simpleMatch(tok, "sizeof (")) {

const Token *tok2 = tok->tokAt(2);

// skip over tokens to find variable or type

while (Token::Match(tok2, "%name% ::|.|[")) {

if (tok2->next()->str() == "[")

tok2 = tok2->linkAt(1)->next();

else

tok2 = tok2->tokAt(2);

}

if (Token::simpleMatch(tok, "sizeof ( *")) {

const ValueType *vt = tok->tokAt(2)->valueType();

const size_t sz = vt ? ValueFlow::getSizeOf(*vt, settings) : 0;

if (sz > 0) {

ValueFlow::Value value(sz);

if (!tok2->isTemplateArg() && settings->platformType != cppcheck::Platform::Unspecified)

value.setKnown();

setTokenValue(tok->next(), value, settings);

}

} else if (tok2->enumerator() && tok2->enumerator()->scope) {

long long size = settings->sizeof_int;

const Token * type = tok2->enumerator()->scope->enumType;

if (type) {

size = getSizeOfType(type, settings);

if (size == 0)

tok->linkAt(1);

}

ValueFlow::Value value(size);

if (!tok2->isTemplateArg() && settings->platformType != cppcheck::Platform::Unspecified)

value.setKnown();

setTokenValue(tok, value, settings);

setTokenValue(tok->next(), value, settings);

} else if (tok2->type() && tok2->type()->isEnumType()) {

long long size = settings->sizeof_int;

if (tok2->type()->classScope) {

const Token * type = tok2->type()->classScope->enumType;

if (type) {

size = getSizeOfType(type, settings);

}

}

ValueFlow::Value value(size);

if (!tok2->isTemplateArg() && settings->platformType != cppcheck::Platform::Unspecified)

value.setKnown();

setTokenValue(tok, value, settings);

setTokenValue(tok->next(), value, settings);

} else if (Token::Match(tok, "sizeof ( %var% ) / sizeof (") && tok->next()->astParent() == tok->tokAt(4)) {

// Get number of elements in array

const Token *sz1 = tok->tokAt(2);

const Token *sz2 = tok->tokAt(7);

const nonneg int varid1 = sz1->varId();

if (varid1 &&

sz1->variable() &&

sz1->variable()->isArray() &&

!sz1->variable()->dimensions().empty() &&

sz1->variable()->dimensionKnown(0) &&

(Token::Match(sz2, "* %varid% )", varid1) || Token::Match(sz2, "%varid% [ 0 ] )", varid1))) {

ValueFlow::Value value(sz1->variable()->dimension(0));

if (!tok2->isTemplateArg() && settings->platformType != cppcheck::Platform::Unspecified)

value.setKnown();

setTokenValue(tok->tokAt(4), value, settings);

}

} else if (Token::Match(tok2, "%var% )")) {

const Variable *var = tok2->variable();

// only look for single token types (no pointers or references yet)

if (var && var->typeStartToken() == var->typeEndToken()) {

// find the size of the type

size_t size = 0;

if (var->isEnumType()) {

size = settings->sizeof_int;

if (var->type()->classScope && var->type()->classScope->enumType)

size = getSizeOfType(var->type()->classScope->enumType, settings);

} else if (var->valueType()) {

size = ValueFlow::getSizeOf(*var->valueType(), settings);

} else if (!var->type()) {

size = getSizeOfType(var->typeStartToken(), settings);

}

// find the number of elements

size_t count = 1;

for (size_t i = 0; i < var->dimensions().size(); ++i) {

if (var->dimensionKnown(i))

count *= var->dimension(i);

else