/*

* Cppcheck - A tool for static C/C++ code analysis

* Copyright (C) 2007-2016 Cppcheck team.

*

* This program is free software: you can redistribute it and/or modify

* it under the terms of the GNU General Public License as published by

* the Free Software Foundation, either version 3 of the License, or

* (at your option) any later version.

*

* This program is distributed in the hope that it will be useful,

* but WITHOUT ANY WARRANTY; without even the implied warranty of

* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

* GNU General Public License for more details.

*

* You should have received a copy of the GNU General Public License

* along with this program. If not, see <http://www.gnu.org/licenses/>.

*/

#include "checkmemoryleak.h"

#include "symboldatabase.h"

#include "mathlib.h"

#include "tokenize.h"

#include "astutils.h"

#include "utils.h"

#include <algorithm>

#include <set>

#include <stack>

//---------------------------------------------------------------------------

// Register this check class (by creating a static instance of it)

namespace {

CheckMemoryLeakInFunction instance1;

CheckMemoryLeakInClass instance2;

CheckMemoryLeakStructMember instance3;

CheckMemoryLeakNoVar instance4;

/**

* Count function parameters

* \param tok Function name token before the '('

*/

unsigned int countParameters(const Token *tok)

{

tok = tok->tokAt(2);

if (tok->str() == ")")

return 0;

unsigned int numpar = 1;

while (nullptr != (tok = tok->nextArgument()))

numpar++;

return numpar;

}

/** List of functions that can be ignored when searching for memory leaks.

* These functions don't take the address of the given pointer

* This list contains function names with const parameters e.g.: atof(const char *)

* TODO: This list should be replaced by <leak-ignore/> in .cfg files.

*/

const std::set<std::string> call_func_white_list = make_container < std::set<std::string> > ()

<< "_open" << "_wopen" << "access" << "adjtime" << "asctime_r" << "asprintf" << "chdir" << "chmod" << "chown"

<< "creat" << "ctime_r" << "execl" << "execle" << "execlp" << "execv" << "execve" << "fchmod" << "fcntl"

<< "fdatasync" << "fclose" << "flock" << "fmemopen" << "fnmatch" << "fopen" << "fopencookie" << "for" << "free"

<< "freopen"<< "fseeko" << "fstat" << "fsync" << "ftello" << "ftruncate" << "getgrnam" << "gethostbyaddr" << "gethostbyname"

<< "getnetbyname" << "getopt" << "getopt_long" << "getprotobyname" << "getpwnam" << "getservbyname" << "getservbyport"

<< "glob" << "gmtime" << "gmtime_r" << "if" << "index" << "inet_addr" << "inet_aton" << "inet_network" << "initgroups"

<< "ioctl" << "link" << "localtime_r" << "lockf" << "lseek" << "lstat" << "mkdir" << "mkfifo" << "mknod" << "mkstemp"

<< "obstack_printf" << "obstack_vprintf" << "open" << "opendir" << "parse_printf_format" << "pathconf"

<< "perror" << "popen" << "posix_fadvise" << "posix_fallocate" << "pread" << "psignal" << "pwrite" << "read" << "readahead"

<< "readdir" << "readdir_r" << "readlink" << "readv" << "realloc" << "regcomp" << "return" << "rewinddir" << "rindex"

<< "rmdir" << "scandir" << "seekdir" << "setbuffer" << "sethostname" << "setlinebuf" << "sizeof" << "strdup"

<< "stat" << "stpcpy" << "strcasecmp" << "stricmp" << "strncasecmp" << "switch"

<< "symlink" << "sync_file_range" << "telldir" << "tempnam" << "time" << "typeid" << "unlink"

<< "utime" << "utimes" << "vasprintf" << "while" << "wordexp" << "write" << "writev";

}

//---------------------------------------------------------------------------

bool CheckMemoryLeak::isclass(const Token *tok, unsigned int varid) const

{

if (tok->isStandardType())

return false;

const Variable * var = tokenizer->getSymbolDatabase()->getVariableFromVarId(varid);

// return false if the type is a simple record type without side effects

// a type that has no side effects (no constructors and no members with constructors)

/** @todo false negative: check base class for side effects */

/** @todo false negative: check constructors for side effects */

if (var && var->typeScope() && var->typeScope()->numConstructors == 0 &&

(var->typeScope()->varlist.empty() || var->type()->needInitialization == Type::True) &&

var->type()->derivedFrom.empty())

return false;

return true;

}

//---------------------------------------------------------------------------

CheckMemoryLeak::AllocType CheckMemoryLeak::getAllocationType(const Token *tok2, unsigned int varid, std::list<const Function*> *callstack) const

{

// What we may have...

// * var = (char *)malloc(10);

// * var = new char[10];

// * var = strdup("hello");

// * var = strndup("hello", 3);

if (tok2 && tok2->str() == "(") {

tok2 = tok2->link();

tok2 = tok2 ? tok2->next() : nullptr;

}

if (! tok2)

return No;

if (tok2->str() == "::")

tok2 = tok2->next();

if (! tok2->isName())

return No;

if (!Token::Match(tok2, "%name% ::|. %type%")) {

// Using realloc..

if (varid && Token::Match(tok2, "realloc ( %any% ,") && tok2->tokAt(2)->varId() != varid)

return Malloc;

if (tokenizer->isCPP() && tok2->str() == "new") {

if (tok2->astOperand1() && (tok2->astOperand1()->str() == "[" || (tok2->astOperand1()->astOperand1() && tok2->astOperand1()->astOperand1()->str() == "[")))

return NewArray;

return New;

}

if (settings1->standards.posix) {

if (Token::Match(tok2, "open|openat|creat|mkstemp|mkostemp|socket (")) {

// simple sanity check of function parameters..

// TODO: Make such check for all these functions

unsigned int num = countParameters(tok2);

if (tok2->str() == "open" && num != 2 && num != 3)

return No;

// is there a user function with this name?

if (tok2->function())

return No;

return Fd;

}

if (Token::simpleMatch(tok2, "popen ("))

return Pipe;

}

// Does tok2 point on a Library allocation function?

const int alloctype = settings1->library.alloc(tok2);

if (alloctype > 0) {

if (alloctype == settings1->library.dealloc("free"))

return Malloc;

if (alloctype == settings1->library.dealloc("fclose"))

return File;

return Library::ismemory(alloctype) ? OtherMem : OtherRes;

}

}

while (Token::Match(tok2,"%name% ::|. %type%"))

tok2 = tok2->tokAt(2);

// User function

const Function* func = tok2->function();

if (func == nullptr)

return No;

// Prevent recursion

if (callstack && std::find(callstack->begin(), callstack->end(), func) != callstack->end())

return No;

std::list<const Function*> cs;

if (!callstack)

callstack = &cs;

callstack->push_back(func);

return functionReturnType(func, callstack);

}

CheckMemoryLeak::AllocType CheckMemoryLeak::getReallocationType(const Token *tok2, unsigned int varid)

{

// What we may have...

// * var = (char *)realloc(..;

if (tok2 && tok2->str() == "(") {

tok2 = tok2->link();

tok2 = tok2 ? tok2->next() : nullptr;

}

if (! tok2)

return No;

if (varid > 0 && ! Token::Match(tok2, "%name% ( %varid% [,)]", varid))

return No;

if (tok2->str() == "realloc")

return Malloc;

return No;

}

CheckMemoryLeak::AllocType CheckMemoryLeak::getDeallocationType(const Token *tok, unsigned int varid) const

{

if (tokenizer->isCPP() && tok->str() == "delete" && tok->astOperand1()) {

const Token* vartok = tok->astOperand1();

if (Token::Match(vartok, ".|::"))

vartok = vartok->astOperand2();

if (vartok && vartok->varId() == varid) {

if (tok->strAt(1) == "[")

return NewArray;

return New;

}

}

if (tok && tok->str() == "::")

tok = tok->next();

if (Token::Match(tok, "%name% (")) {

if (Token::simpleMatch(tok, "fcloseall ( )"))

return File;

const Token* vartok = tok->tokAt(2);

while (Token::Match(vartok, "%name% .|::"))

vartok = vartok->tokAt(2);

if (Token::Match(vartok, "%varid% )|,|-", varid)) {

if (tok->str() == "realloc" && Token::simpleMatch(vartok->next(), ", 0 )"))

return Malloc;

if (settings1->standards.posix) {

if (tok->str() == "close")

return Fd;

if (tok->str() == "pclose")

return Pipe;

}

// Does tok point on a Library deallocation function?

const int dealloctype = settings1->library.dealloc(tok);

if (dealloctype > 0) {

if (dealloctype == settings1->library.dealloc("free"))

return Malloc;

if (dealloctype == settings1->library.dealloc("fclose"))

return File;

return Library::ismemory(dealloctype) ? OtherMem : OtherRes;

}

}

}

return No;

}

//--------------------------------------------------------------------------

//--------------------------------------------------------------------------

void CheckMemoryLeak::memoryLeak(const Token *tok, const std::string &varname, AllocType alloctype)

{

if (alloctype == CheckMemoryLeak::File ||

alloctype == CheckMemoryLeak::Pipe ||

alloctype == CheckMemoryLeak::Fd ||

alloctype == CheckMemoryLeak::OtherRes)

resourceLeakError(tok, varname);

else

memleakError(tok, varname);

}

//---------------------------------------------------------------------------

void CheckMemoryLeak::reportErr(const Token *tok, Severity::SeverityType severity, const std::string &id, const std::string &msg, unsigned int cwe) const

{

std::list<const Token *> callstack;

if (tok)

callstack.push_back(tok);

reportErr(callstack, severity, id, msg, cwe);

}

void CheckMemoryLeak::reportErr(const std::list<const Token *> &callstack, Severity::SeverityType severity, const std::string &id, const std::string &msg, unsigned int cwe) const

{

ErrorLogger::ErrorMessage errmsg(callstack, tokenizer?&tokenizer->list:0, severity, id, msg, false);

errmsg._cwe = cwe;

if (errorLogger)

errorLogger->reportErr(errmsg);

else

Check::reportError(errmsg);

}

void CheckMemoryLeak::memleakError(const Token *tok, const std::string &varname) const

{

reportErr(tok, Severity::error, "memleak", "Memory leak: " + varname, 401U);

}

void CheckMemoryLeak::memleakUponReallocFailureError(const Token *tok, const std::string &varname) const

{

reportErr(tok, Severity::error, "memleakOnRealloc", "Common realloc mistake: \'" + varname + "\' nulled but not freed upon failure", 401U);

}

void CheckMemoryLeak::resourceLeakError(const Token *tok, const std::string &varname) const

{

std::string errmsg("Resource leak");

if (!varname.empty())

errmsg += ": " + varname;

reportErr(tok, Severity::error, "resourceLeak", errmsg, 775U);

}

void CheckMemoryLeak::deallocDeallocError(const Token *tok, const std::string &varname) const

{

reportErr(tok, Severity::error, "deallocDealloc", "Deallocating a deallocated pointer: " + varname, 415U);

}

void CheckMemoryLeak::deallocuseError(const Token *tok, const std::string &varname) const

{

reportErr(tok, Severity::error, "deallocuse", "Dereferencing '" + varname + "' after it is deallocated / released", 416U);

}

void CheckMemoryLeak::mismatchSizeError(const Token *tok, const std::string &sz) const

{

reportErr(tok, Severity::error, "mismatchSize", "The allocated size " + sz + " is not a multiple of the underlying type's size.", 131U);

}

void CheckMemoryLeak::mismatchAllocDealloc(const std::list<const Token *> &callstack, const std::string &varname) const

{

reportErr(callstack, Severity::error, "mismatchAllocDealloc", "Mismatching allocation and deallocation: " + varname, 762U);

}

CheckMemoryLeak::AllocType CheckMemoryLeak::functionReturnType(const Function* func, std::list<const Function*> *callstack) const

{

if (!func || !func->hasBody())

return No;

// Get return pointer..

unsigned int varid = 0;

for (const Token *tok2 = func->functionScope->classStart; tok2 != func->functionScope->classEnd; tok2 = tok2->next()) {

if (tok2->str() == "return") {

AllocType allocType = getAllocationType(tok2->next(), 0, callstack);

if (allocType != No)

return allocType;

if (tok2->scope() != func->functionScope || !tok2->astOperand1())

return No;

const Token* tok = tok2->astOperand1();

if (Token::Match(tok, ".|::"))

tok = tok->astOperand2() ? tok->astOperand2() : tok->astOperand1();

if (tok)

varid = tok->varId();

break;

}

}

// Not returning pointer value..

if (varid == 0)

return No;

// If variable is not local then alloctype shall be "No"

// Todo: there can be false negatives about mismatching allocation/deallocation.

// => Generate "alloc ; use ;" if variable is not local?

const Variable *var = tokenizer->getSymbolDatabase()->getVariableFromVarId(varid);

if (!var || !var->isLocal() || var->isStatic())

return No;

// Check if return pointer is allocated..

AllocType allocType = No;

for (const Token* tok = func->functionScope->classStart; tok != func->functionScope->classEnd; tok = tok->next()) {

if (Token::Match(tok, "%varid% =", varid)) {

allocType = getAllocationType(tok->tokAt(2), varid, callstack);

}

if (Token::Match(tok, "= %varid% ;", varid)) {

return No;

}

if (!tokenizer->isC() && Token::Match(tok, "[(,] %varid% [,)]", varid)) {

return No;

}

if (Token::Match(tok, "[(,] & %varid% [.,)]", varid)) {

return No;

}

if (allocType == No && tok->str() == "return")

return No;

}

return allocType;

}

const char *CheckMemoryLeak::functionArgAlloc(const Function *func, unsigned int targetpar, AllocType &allocType) const

{

allocType = No;

if (!func || !func->functionScope)

return "";

if (!Token::simpleMatch(func->retDef, "void"))

return "";

std::list<Variable>::const_iterator arg = func->argumentList.begin();

for (; arg != func->argumentList.end(); ++arg) {

if (arg->index() == targetpar-1)

break;

}

if (arg == func->argumentList.end())

return "";

// Is **

if (!arg->isPointer())

return "";

const Token* tok = arg->typeEndToken();

tok = tok->previous();

if (tok->str() != "*")

return "";

// Check if pointer is allocated.

int realloc = 0;

for (tok = func->functionScope->classStart; tok && tok != func->functionScope->classEnd; tok = tok->next()) {

if (tok->varId() == arg->declarationId()) {

if (Token::Match(tok->tokAt(-3), "free ( * %name% )")) {

realloc = 1;

allocType = No;

} else if (Token::Match(tok->previous(), "* %name% =")) {

allocType = getAllocationType(tok->tokAt(2), arg->declarationId());

if (allocType == No) {

allocType = getReallocationType(tok->tokAt(2), arg->declarationId());

}

if (allocType != No) {

if (realloc)

return "realloc";

return "alloc";

}

} else {

// unhandled variable usage: bailout

return "";

}

}

}

return "";

}

static bool notvar(const Token *tok, unsigned int varid)

{

if (!tok)

return false;

if (Token::Match(tok, "&&|;"))

return notvar(tok->astOperand1(),varid) || notvar(tok->astOperand2(),varid);

if (tok->str() == "(" && Token::Match(tok->astOperand1(), "UNLIKELY|LIKELY"))

return notvar(tok->astOperand2(), varid);

const Token *vartok = astIsVariableComparison(tok, "==", "0");

return vartok && (vartok->varId() == varid);

}

static bool ifvar(const Token *tok, unsigned int varid, const std::string &comp, const std::string &rhs)

{

if (!Token::simpleMatch(tok, "if ("))

return false;

const Token *condition = tok->next()->astOperand2();

if (condition && condition->str() == "(" && Token::Match(condition->astOperand1(), "UNLIKELY|LIKELY"))

condition = condition->astOperand2();

if (!condition || condition->str() == "&&")

return false;

const Token *vartok = astIsVariableComparison(condition, comp, rhs);

return (vartok && vartok->varId() == varid);

}

static bool alwaysTrue(const Token *tok)

{

if (!tok)

return false;

if (tok->values.size() == 1U &&

tok->values.front().intvalue != 0 &&

tok->values.front().isKnown())

return true;

if (tok->str() == "||")

return alwaysTrue(tok->astOperand1()) || alwaysTrue(tok->astOperand2());

if (tok->str() == "true")

return true;

return (tok->isComparisonOp() &&

tok->values.size() == 1U &&

tok->values.front().isKnown() &&

tok->values.front().intvalue != 0);

}

bool CheckMemoryLeakInFunction::test_white_list(const std::string &funcname, const Settings *settings, bool cpp)

{

return ((call_func_white_list.find(funcname)!=call_func_white_list.end()) || (settings->library.leakignore.find(funcname) != settings->library.leakignore.end()) || (cpp && funcname == "delete"));

}

namespace {

const std::set<std::string> call_func_keywords = make_container < std::set<std::string> > ()

<< "asprintf"

<< "delete"

<< "fclose"

<< "for"

<< "free"

<< "if"

<< "realloc"

<< "return"

<< "switch"

<< "while"

<< "sizeof";

}

const char * CheckMemoryLeakInFunction::call_func(const Token *tok, std::list<const Token *> callstack, const unsigned int varid, AllocType &alloctype, AllocType &dealloctype, bool &allocpar, unsigned int sz)

{

if (test_white_list(tok->str(), _settings, tokenizer->isCPP())) {

if (call_func_keywords.find(tok->str())!=call_func_keywords.end())

return 0;

// is the varid a parameter?

for (const Token *tok2 = tok->tokAt(2); tok2 && tok2 != tok->linkAt(1); tok2 = tok2->next()) {

if (tok2->str() == "(") {

tok2 = tok2->nextArgument();

if (!tok2)

break;

}

if (tok2->varId() == varid) {

if (tok->strAt(-1) == ".")

return "use";

else if (tok2->strAt(1) == "=")

return "assign";

else if (tok->str()=="printf")

return "use"; // <- it is not certain printf dereference the pointer TODO: check the format string

else

return "use_";

}

}

return 0;

}

if (_settings->library.isnoreturn(tok) && tok->strAt(-1) != "=")

return "exit";

if (varid > 0 && (getReallocationType(tok, varid) != No || getDeallocationType(tok, varid) != No))

return 0;

if (callstack.size() > 2)

return "dealloc_";

const std::string& funcname(tok->str());

for (std::list<const Token *>::const_iterator it = callstack.begin(); it != callstack.end(); ++it) {

if ((*it) && (*it)->str() == funcname)

return "recursive";

}

callstack.push_back(tok);

// lock/unlock..

if (varid == 0) {

const Function* func = tok->function();

if (!func || !func->hasBody())

return 0;

Token *ftok = getcode(func->functionScope->classStart->next(), callstack, 0, alloctype, dealloctype, false, 1);

simplifycode(ftok);

const char *ret = nullptr;

if (Token::simpleMatch(ftok, "; alloc ; }"))

ret = "alloc";

else if (Token::simpleMatch(ftok, "; dealloc ; }"))

ret = "dealloc";

TokenList::deleteTokens(ftok);

return ret;

}

// how many parameters is there in the function call?

const unsigned int numpar = countParameters(tok);

if (numpar == 0) {

// Taking return value => it is not a noreturn function

if (tok->strAt(-1) == "=")

return nullptr;

// Function is not noreturn

if (tok->function() && tok->function()->functionScope) {

std::string temp;

if (!_settings->library.isScopeNoReturn(tok->function()->functionScope->classEnd, &temp) && temp.empty())

return nullptr;

} else if (_settings->library.isnotnoreturn(tok))

return nullptr;

return "callfunc";

}

unsigned int par = 0;

const bool dot(tok->previous()->str() == ".");

const bool eq(tok->previous()->str() == "=");

const Token *functok = tok;

tok = Token::findsimplematch(tok, "(");

if (tok)

tok = tok->next();

for (; tok; tok = tok->nextArgument()) {

++par;

if (Token::Match(tok, "%varid% [,()]", varid)) {

if (dot)

return "use";

const Function* function = functok->function();

if (!function)

return "use";

// how many parameters does the function want?

if (numpar != function->argCount()) // TODO: Handle default parameters

return "recursive";

if (!function->functionScope)

return "use";

const Variable* param = function->getArgumentVar(par-1);

if (!param || !param->nameToken())

return "use";

Token *func = getcode(function->functionScope->classStart->next(), callstack, param->declarationId(), alloctype, dealloctype, false, sz);

//simplifycode(func);

const Token *func_ = func;

while (func_ && func_->str() == ";")

func_ = func_->next();

const char *ret = nullptr;

/** @todo handle "goto" */

if (Token::findsimplematch(func_, "dealloc"))

ret = "dealloc";

else if (Token::findsimplematch(func_, "use"))

ret = "use";

else if (Token::findsimplematch(func_, "&use"))

ret = "&use";

TokenList::deleteTokens(func);

return ret;

}

if (Token::Match(tok, "& %varid% [,()]", varid)) {

const Function *func = functok->function();

if (func == nullptr)

continue;

AllocType a;

const char *ret = functionArgAlloc(func, par, a);

if (a != No) {

if (alloctype == No)

alloctype = a;

else if (alloctype != a)

alloctype = Many;

allocpar = true;

return ret;

}

}

if (Token::Match(tok, "%varid% . %name% [,)]", varid))

return "use";

}

return (eq || _settings->experimental) ? 0 : "callfunc";

}

static void addtoken(Token **rettail, const Token *tok, const std::string &str)

{

(*rettail)->insertToken(str);

(*rettail) = (*rettail)->next();

(*rettail)->linenr(tok->linenr());

(*rettail)->fileIndex(tok->fileIndex());

}

Token *CheckMemoryLeakInFunction::getcode(const Token *tok, std::list<const Token *> callstack, const unsigned int varid, CheckMemoryLeak::AllocType &alloctype, CheckMemoryLeak::AllocType &dealloctype, bool classmember, unsigned int sz)

{

// variables whose value depends on if(!var). If one of these variables

// is used in a if-condition then generate "ifv" instead of "if".

std::set<unsigned int> extravar;

// The first token should be ";"

Token* rethead = new Token(0);

rethead->str(";");

rethead->linenr(tok->linenr());

rethead->fileIndex(tok->fileIndex());

Token* rettail = rethead;

int indentlevel = 0;

int parlevel = 0;

for (; tok; tok = tok->next()) {

if (tok->str() == "{") {

addtoken(&rettail, tok, "{");

++indentlevel;

} else if (tok->str() == "}") {

addtoken(&rettail, tok, "}");

if (indentlevel <= 0)

break;

--indentlevel;

}

else if (tok->str() == "(")

++parlevel;

else if (tok->str() == ")")

--parlevel;

if (parlevel == 0 && tok->str() == ";")

addtoken(&rettail, tok, ";");

// Start of new statement.. check if the statement has anything interesting

if (varid > 0 && parlevel == 0 && Token::Match(tok, "[;{}]")) {

if (Token::Match(tok->next(), "[{};]"))

continue;

// function calls are interesting..

const Token *tok2 = tok;

while (Token::Match(tok2->next(), "%name% ."))

tok2 = tok2->tokAt(2);

if (Token::Match(tok2->next(), "%name% ("))

;

else if (Token::Match(tok->next(), "continue|break|return|throw|goto|do|else"))

;

else {

const Token *skipToToken = nullptr;

// scan statement for interesting keywords / varid

for (tok2 = tok->next(); tok2; tok2 = tok2->next()) {

if (tok2->str() == ";") {

// nothing interesting found => skip this statement

skipToToken = tok2->previous();

break;

}

if (tok2->varId() == varid ||

tok2->str() == ":" || tok2->str() == "{" || tok2->str() == "}") {

break;

}

}

if (skipToToken) {

tok = skipToToken;

continue;

}

}

}

if (varid == 0) {

if (!callstack.empty() && Token::Match(tok, "[;{}] __cppcheck_lock|__cppcheck_unlock ( ) ;")) {

// Type of leak = Resource leak

alloctype = dealloctype = CheckMemoryLeak::File;

if (tok->next()->str() == "__cppcheck_lock") {

addtoken(&rettail, tok, "alloc");

} else {

addtoken(&rettail, tok, "dealloc");

}

tok = tok->tokAt(3);

continue;

}

if (Token::simpleMatch(tok, "if (")) {

addtoken(&rettail, tok, "if");

tok = tok->next()->link();

continue;

}

} else {

if (Token::Match(tok, "%varid% = close ( %varid% )", varid)) {

addtoken(&rettail, tok, "dealloc");

addtoken(&rettail, tok, ";");

addtoken(&rettail, tok, "assign");

addtoken(&rettail, tok, ";");

tok = tok->tokAt(5);

continue;

}

// var = strcpy|.. ( var ,

if (Token::Match(tok, "[;{}] %varid% = memcpy|memmove|memset|strcpy|strncpy|strcat|strncat ( %varid% ,", varid)) {

tok = tok->linkAt(4);

continue;

}

if (Token::Match(tok->previous(), "[(;{}] %varid% =", varid) ||

Token::Match(tok, "asprintf|vasprintf ( & %varid% ,", varid)) {

CheckMemoryLeak::AllocType alloc;

if (Token::Match(tok, "asprintf|vasprintf (")) {

// todo: check how the return value is used.

if (!Token::Match(tok->previous(), "[;{}]")) {

TokenList::deleteTokens(rethead);

return 0;

}

alloc = Malloc;

tok = tok->next()->link();

} else {

alloc = getAllocationType(tok->tokAt(2), varid);

}

if (sz > 1 &&

Token::Match(tok->tokAt(2), "malloc ( %num% )") &&

(MathLib::toLongNumber(tok->strAt(4)) % long(sz)) != 0) {

mismatchSizeError(tok->tokAt(4), tok->strAt(4));

}

if (alloc == CheckMemoryLeak::No) {

alloc = getReallocationType(tok->tokAt(2), varid);

if (alloc != CheckMemoryLeak::No) {

addtoken(&rettail, tok, "realloc");

addtoken(&rettail, tok, ";");

tok = tok->tokAt(2);

if (Token::Match(tok, "%name% ("))

tok = tok->next()->link();

continue;

}

}

// don't check classes..

if (alloc == CheckMemoryLeak::New) {

if (Token::Match(tok->tokAt(2), "new struct| %type% [(;]")) {

const int offset = tok->strAt(3) == "struct" ? 1 : 0;

if (isclass(tok->tokAt(3 + offset), varid)) {

alloc = No;

}

} else if (Token::Match(tok->tokAt(2), "new ( nothrow ) struct| %type%")) {

const int offset = tok->strAt(6) == "struct" ? 1 : 0;

if (isclass(tok->tokAt(6 + offset), varid)) {

alloc = No;

}

} else if (Token::Match(tok->tokAt(2), "new ( std :: nothrow ) struct| %type%")) {

const int offset = tok->strAt(8) == "struct" ? 1 : 0;

if (isclass(tok->tokAt(8 + offset), varid)) {

alloc = No;

}

}

if (alloc == No && alloctype == No)

alloctype = CheckMemoryLeak::New;

}

if (alloc != No) {

addtoken(&rettail, tok, "alloc");

if (alloctype != No && alloctype != alloc)

alloc = Many;

if (alloc != Many && dealloctype != No && dealloctype != Many && dealloctype != alloc) {

callstack.push_back(tok);

mismatchAllocDealloc(callstack, Token::findmatch(_tokenizer->tokens(), "%varid%", varid)->str());

callstack.pop_back();

}

alloctype = alloc;

if (Token::Match(tok, "%name% = %type% (")) {

tok = tok->linkAt(3);

continue;

}

}

// assignment..

else {

// is the pointer in rhs?

bool rhs = false;

bool trailingSemicolon = false;

bool used = false;

for (const Token *tok2 = tok->next(); tok2; tok2 = tok2->next()) {

if (tok2->str() == ";") {

trailingSemicolon = true;

if (rhs)

tok = tok2;

break;

}

if (!used && !rhs) {

if (Token::Match(tok2, "[=+(,] %varid%", varid)) {

if (Token::Match(tok2, "[(,]")) {

used = true;

addtoken(&rettail, tok, "use");

addtoken(&rettail, tok, ";");

}

rhs = true;

}

}

}

if (!used) {

if (!rhs)

addtoken(&rettail, tok, "assign");

else {

addtoken(&rettail, tok, "use_");

if (trailingSemicolon)

addtoken(&rettail, tok, ";");

}

}

continue;

}

}

if (Token::Match(tok->previous(), "%op%|;|{|}|) ::| %name%") || (Token::Match(tok->previous(), "( ::| %name%") && (!rettail || rettail->str() != "loop"))) {

if (Token::Match(tok, "%varid% ?", varid))

tok = tok->tokAt(2);

AllocType dealloc = getDeallocationType(tok, varid);

if (dealloc != No && tok->str() == "fcloseall" && alloctype != dealloc)

;

else if (dealloc != No) {

addtoken(&rettail, tok, "dealloc");

if (dealloctype != No && dealloctype != dealloc)

dealloc = Many;

if (dealloc != Many && alloctype != No && alloctype != Many && alloctype != dealloc) {

callstack.push_back(tok);

mismatchAllocDealloc(callstack, Token::findmatch(_tokenizer->tokens(), "%varid%", varid)->str());

callstack.pop_back();

}

dealloctype = dealloc;

if (tok->strAt(2) == "(")

tok = tok->linkAt(2);

continue;

}

}

// if else switch

if (Token::simpleMatch(tok, "if (")) {

if (alloctype == Fd) {

if (ifvar(tok, varid, ">", "-1") ||

ifvar(tok, varid, ">=", "0") ||

ifvar(tok, varid, ">", "0") ||

ifvar(tok, varid, "!=", "-1")) {

addtoken(&rettail, tok, "if(var)");

tok = tok->next()->link();

continue;

} else if (ifvar(tok, varid, "==", "-1") ||

ifvar(tok, varid, "<", "0")) {

addtoken(&rettail, tok, "if(!var)");

tok = tok->next()->link();

continue;

}

}

if (ifvar(tok, varid, "!=", "0")) {

addtoken(&rettail, tok, "if(var)");

// Make sure the "use" will not be added

tok = tok->next()->link();

continue;

} else if (ifvar(tok, varid, "==", "0")) {

addtoken(&rettail, tok, "if(!var)");

// parse the if-body.

// if a variable is assigned then add variable to "extravar".

for (const Token *tok2 = tok->next()->link()->tokAt(2); tok2; tok2 = tok2->next()) {

if (tok2->str() == "{")

tok2 = tok2->link();

else if (tok2->str() == "}")

break;

else if (Token::Match(tok2, "%var% ="))

extravar.insert(tok2->varId());

}

tok = tok->next()->link();

continue;

} else {

// Check if the condition depends on var or extravar somehow..

bool dep = false;

const Token* const end = tok->linkAt(1);

for (const Token *tok2 = tok->next(); tok2 != end; tok2 = tok2->next()) {

if (Token::Match(tok2, "close|pclose|fclose|closedir ( %varid% )", varid)) {

addtoken(&rettail, tok, "dealloc");

addtoken(&rettail, tok, ";");

dep = true;

break;

} else if (alloctype == Fd && Token::Match(tok2, "%varid% !=|>=", varid)) {

dep = true;

} else if (Token::Match(tok2, "! %varid%", varid)) {

dep = true;

} else if (Token::Match(tok2, "%name% (") && !test_white_list(tok2->str(), _settings, tokenizer->isCPP())) {

bool use = false;

for (const Token *tok3 = tok2->tokAt(2); tok3; tok3 = tok3->nextArgument()) {

if (Token::Match(tok3->previous(), "(|, &| %varid% ,|)", varid)) {

use = true;

break;

}

}

if (use) {

addtoken(&rettail, tok, "use");

addtoken(&rettail, tok, ";");

dep = false;

break;

}

} else if (tok2->varId() && extravar.find(tok2->varId()) != extravar.end()) {

dep = true;

} else if (tok2->varId() == varid &&

(tok2->next()->isConstOp() || tok2->previous()->isConstOp()))

dep = true;

}

if (notvar(tok->next()->astOperand2(), varid))

addtoken(&rettail, tok, "if(!var)");

else

addtoken(&rettail, tok, (dep ? "ifv" : "if"));

tok = tok->next()->link();

continue;

}