Fixed #9679 (False positive: use this after free (lambda not executed directly))

danmar · danmar · commit aa1bbf2e623b · 2020-04-17T20:20:45.000+02:00
diff --git a/lib/checkclass.cpp b/lib/checkclass.cpp
@@ -2699,9 +2699,12 @@ bool CheckClass::checkThisUseAfterFreeRecursive(const Scope *classScope, const F
         } else if (isDestroyed && Token::Match(tok->previous(), "!!. %name%") && tok->variable() && tok->variable()->scope() == classScope && !tok->variable()->isStatic() && !tok->variable()->isArgument()) {
             thisUseAfterFree(selfPointer->nameToken(), *freeToken, tok);
             return true;
-        } else if (*freeToken && Token::Match(tok, "return|throw"))
+        } else if (*freeToken && Token::Match(tok, "return|throw")) {
             // TODO
             return tok->str() == "throw";
+        } else if (tok->str() == "{" && tok->scope()->type == Scope::ScopeType::eLambda) {
+            tok = tok->link();
+        }
     }
     return false;
 }
diff --git a/test/testclass.cpp b/test/testclass.cpp
@@ -7306,6 +7306,22 @@ class TestClass : public TestFixture {
                               "\n"
                               "C* C::instanceSingleton;");
         ASSERT_EQUALS("", errout.str());
+
+        // Avoid false positive when pointer is deleted in lambda
+        checkThisUseAfterFree("class C {\n"
+                              "public:\n"
+                              "    void foo();\n"
+                              "    void set() { p = this; }\n"
+                              "    void dostuff() {}\n"
+                              "    C* p;\n"
+                              "};\n"
+                              "\n"
+                              "void C::foo() {\n"
+                              "    auto done = [this] () { delete p; };\n"
+                              "    dostuff();\n"
+                              "    done();\n"
+                              "}");
+        ASSERT_EQUALS("", errout.str());
     }
 };
 

Original file line number	Diff line number	Diff line change
`@@ -2699,9 +2699,12 @@ bool CheckClass::checkThisUseAfterFreeRecursive(const Scope *classScope, const F`
`2699`	`2699`	`} else if (isDestroyed && Token::Match(tok->previous(), "!!. %name%") && tok->variable() && tok->variable()->scope() == classScope && !tok->variable()->isStatic() && !tok->variable()->isArgument()) {`
`2700`	`2700`	`thisUseAfterFree(selfPointer->nameToken(), *freeToken, tok);`
`2701`	`2701`	`return true;`
`2702`		`- } else if (*freeToken && Token::Match(tok, "return\|throw"))`
	`2702`	`+ } else if (*freeToken && Token::Match(tok, "return\|throw")) {`
`2703`	`2703`	`// TODO`
`2704`	`2704`	`return tok->str() == "throw";`
	`2705`	`+ } else if (tok->str() == "{" && tok->scope()->type == Scope::ScopeType::eLambda) {`
	`2706`	`+ tok = tok->link();`
	`2707`	`+ }`
`2705`	`2708`	`}`
`2706`	`2709`	`return false;`
`2707`	`2710`	`}`