/*

* Cppcheck - A tool for static C/C++ code analysis

* Copyright (C) 2007-2019 Cppcheck team.

*

* This program is free software: you can redistribute it and/or modify

* it under the terms of the GNU General Public License as published by

* the Free Software Foundation, either version 3 of the License, or

* (at your option) any later version.

*

* This program is distributed in the hope that it will be useful,

* but WITHOUT ANY WARRANTY; without even the implied warranty of

* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

* GNU General Public License for more details.

*

* You should have received a copy of the GNU General Public License

* along with this program. If not, see <http://www.gnu.org/licenses/>.

*/

#include "checkautovariables.h"

#include "settings.h"

#include "testsuite.h"

#include "tokenize.h"

class TestAutoVariables : public TestFixture {

public:

TestAutoVariables() : TestFixture("TestAutoVariables") {

}

private:

Settings settings;

void check(const char code[], bool inconclusive = false, const char* filename = "test.cpp") {

// Clear the error buffer..

errout.str("");

settings.inconclusive = inconclusive;

// Tokenize..

Tokenizer tokenizer(&settings, this);

std::istringstream istr(code);

tokenizer.tokenize(istr, filename);

CheckAutoVariables checkAutoVariables;

checkAutoVariables.runChecks(&tokenizer, &settings, this);

}

void run() OVERRIDE {

settings.addEnabled("warning");

settings.addEnabled("style");

LOAD_LIB_2(settings.library, "std.cfg");

LOAD_LIB_2(settings.library, "qt.cfg");

TEST_CASE(testautovar1);

TEST_CASE(testautovar2);

TEST_CASE(testautovar3); // ticket #2925

TEST_CASE(testautovar4); // ticket #2928

TEST_CASE(testautovar5); // ticket #2926

TEST_CASE(testautovar6); // ticket #2931

TEST_CASE(testautovar7); // ticket #3066

TEST_CASE(testautovar8);

TEST_CASE(testautovar9);

TEST_CASE(testautovar10); // ticket #2930 - void f(char *p) { p = '\0'; }

TEST_CASE(testautovar11); // ticket #4641 - fp, assign local struct member address to function parameter

TEST_CASE(testautovar12); // ticket #5024 - crash

TEST_CASE(testautovar13); // ticket #5537 - crash

TEST_CASE(testautovar14); // ticket #4776 - assignment of function parameter, goto

TEST_CASE(testautovar15); // ticket #6538

TEST_CASE(testautovar16); // ticket #8114

TEST_CASE(testautovar_array1);

TEST_CASE(testautovar_array2);

TEST_CASE(testautovar_normal); // "normal" token list that does not remove casts etc

TEST_CASE(testautovar_ptrptr); // ticket #6956

TEST_CASE(testautovar_return1);

TEST_CASE(testautovar_return2);

TEST_CASE(testautovar_return3);

TEST_CASE(testautovar_return4);

TEST_CASE(testautovar_extern);

TEST_CASE(testinvaliddealloc);

TEST_CASE(testinvaliddealloc_C);

TEST_CASE(testassign1); // Ticket #1819

TEST_CASE(testassign2); // Ticket #2765

TEST_CASE(assignAddressOfLocalArrayToGlobalPointer);

TEST_CASE(assignAddressOfLocalVariableToGlobalPointer);

TEST_CASE(assignAddressOfLocalVariableToMemberVariable);

TEST_CASE(returnLocalVariable1);

TEST_CASE(returnLocalVariable2);

TEST_CASE(returnLocalVariable3); // &x[0]

TEST_CASE(returnLocalVariable4); // x+y

TEST_CASE(returnLocalVariable5); // cast

TEST_CASE(returnLocalVariable6); // valueflow

// return reference..

TEST_CASE(returnReference1);

TEST_CASE(returnReference2);

TEST_CASE(returnReference3);

TEST_CASE(returnReference4);

TEST_CASE(returnReference5);

TEST_CASE(returnReference6);

TEST_CASE(returnReference7);

TEST_CASE(returnReference8);

TEST_CASE(returnReference9);

TEST_CASE(returnReference10);

TEST_CASE(returnReference11);

TEST_CASE(returnReference12);

TEST_CASE(returnReference13);

TEST_CASE(returnReference14);

TEST_CASE(returnReference15); // #9432

TEST_CASE(returnReference16); // #9433

TEST_CASE(returnReference16); // #9433

TEST_CASE(returnReference17); // #9461

TEST_CASE(returnReference18); // #9482

TEST_CASE(returnReferenceFunction);

TEST_CASE(returnReferenceContainer);

TEST_CASE(returnReferenceLiteral);

TEST_CASE(returnReferenceCalculation);

TEST_CASE(returnReferenceLambda);

TEST_CASE(returnReferenceInnerScope);

TEST_CASE(returnReferenceRecursive);

TEST_CASE(extendedLifetime);

TEST_CASE(danglingReference);

// global namespace

TEST_CASE(testglobalnamespace);

TEST_CASE(returnParameterAddress);

TEST_CASE(testconstructor); // ticket #5478 - crash

TEST_CASE(variableIsUsedInScope); // ticket #5599 crash in variableIsUsedInScope()

TEST_CASE(danglingLifetimeLambda);

TEST_CASE(danglingLifetimeContainer);

TEST_CASE(danglingLifetime);

TEST_CASE(danglingLifetimeFunction);

TEST_CASE(danglingLifetimeAggegrateConstructor);

TEST_CASE(danglingLifetimeInitList);

TEST_CASE(danglingLifetimeImplicitConversion);

TEST_CASE(danglingTemporaryLifetime);

TEST_CASE(invalidLifetime);

TEST_CASE(deadPointer);

}

void testautovar1() {

check("void func1(int **res)\n"

"{\n"

" int num = 2;\n"

" *res = &num;\n"

"}");

ASSERT_EQUALS("[test.cpp:4]: (error) Address of local auto-variable assigned to a function parameter.\n", errout.str());

check("void func1(int **res)\n"

"{\n"

" int num = 2;\n"

" res = &num;\n"

"}");

ASSERT_EQUALS("[test.cpp:4]: (warning) Assignment of function parameter has no effect outside the function. Did you forget dereferencing it?\n", errout.str());

check("void func1(int **res)\n"

"{\n"

" int num = 2;\n"

" foo.res = &num;\n"

"}");

ASSERT_EQUALS("", errout.str());

}

void testautovar2() {

check("class Fred {\n"

" void func1(int **res);\n"

"}\n"

"void Fred::func1(int **res)\n"

"{\n"

" int num = 2;\n"

" *res = &num;\n"

"}");

ASSERT_EQUALS("[test.cpp:7]: (error) Address of local auto-variable assigned to a function parameter.\n", errout.str());

check("class Fred {\n"

" void func1(int **res);\n"

"}\n"

"void Fred::func1(int **res)\n"

"{\n"

" int num = 2;\n"

" res = &num;\n"

"}");

ASSERT_EQUALS("[test.cpp:7]: (warning) Assignment of function parameter has no effect outside the function. Did you forget dereferencing it?\n", errout.str());

check("class Fred {\n"

" void func1(int **res);\n"

"}\n"

"void Fred::func1(int **res)\n"

"{\n"

" int num = 2;\n"

" foo.res = &num;\n"

"}");

ASSERT_EQUALS("", errout.str());

}

void testautovar3() { // ticket #2925

check("void foo(int **p)\n"

"{\n"

" int x[100];\n"

" *p = x;\n"

"}");

ASSERT_EQUALS("[test.cpp:4]: (error) Address of local auto-variable assigned to a function parameter.\n", errout.str());

}

void testautovar4() { // ticket #2928

check("void foo(int **p)\n"

"{\n"

" static int x[100];\n"

" *p = x;\n"

"}");

ASSERT_EQUALS("", errout.str());

}

void testautovar5() { // ticket #2926

check("void foo(struct AB *ab)\n"

"{\n"

" char a;\n"

" ab->a = &a;\n"

"}");

ASSERT_EQUALS("[test.cpp:4]: (error) Address of local auto-variable assigned to a function parameter.\n", errout.str());

}

void testautovar6() { // ticket #2931

check("void foo(struct X *x)\n"

"{\n"

" char a[10];\n"

" x->str = a;\n"

"}", false);

ASSERT_EQUALS("", errout.str());

check("void foo(struct X *x)\n"

"{\n"

" char a[10];\n"

" x->str = a;\n"

"}", true);

ASSERT_EQUALS("[test.cpp:4]: (error, inconclusive) Address of local auto-variable assigned to a function parameter.\n", errout.str());

}

void testautovar7() { // ticket #3066

check("struct txt_scrollpane_s * TXT_NewScrollPane(struct txt_widget_s * target)\n"

"{\n"

" struct txt_scrollpane_s * scrollpane;\n"

" target->parent = &scrollpane->widget;\n"

" return scrollpane;\n"

"}", false);

ASSERT_EQUALS("", errout.str());

}

void testautovar8() {

check("void foo(int*& p) {\n"

" int i = 0;\n"

" p = &i;\n"

"}", false);

ASSERT_EQUALS("[test.cpp:3]: (error) Address of local auto-variable assigned to a function parameter.\n", errout.str());

check("void foo(std::string& s) {\n"

" s = foo;\n"

"}", false);

ASSERT_EQUALS("", errout.str());

}

void testautovar9() {

check("struct FN {int i;};\n"

"struct FP {FN* f};\n"

"void foo(int*& p, FN* p_fp) {\n"

" FN fn;\n"

" FP fp;\n"

" p = &fn.i;\n"

" p = &p_fp->i;\n"

" p = &fp.f->i;\n"

"}", false);

ASSERT_EQUALS("[test.cpp:6]: (error) Address of local auto-variable assigned to a function parameter.\n", errout.str());

}

void testautovar10() { // #2930 - assignment of function parameter

check("void foo(char* p) {\n"

" p = 0;\n"

"}");

ASSERT_EQUALS("[test.cpp:2]: (warning) Assignment of function parameter has no effect outside the function. Did you forget dereferencing it?\n", errout.str());

check("void foo(int b) {\n"

" b = foo(b);\n"

"}");

ASSERT_EQUALS("[test.cpp:2]: (style) Assignment of function parameter has no effect outside the function.\n", errout.str());

check("void foo(int b) {\n"

" b += 1;\n"

"}");

ASSERT_EQUALS("[test.cpp:2]: (style) Assignment of function parameter has no effect outside the function.\n", errout.str());

check("void foo(std::string s) {\n"

" s = foo(b);\n"

"}");

ASSERT_EQUALS("[test.cpp:2]: (style) Assignment of function parameter has no effect outside the function.\n", errout.str());

check("void foo(char* p) {\n" // don't warn for self assignment, there is another warning for this

" p = p;\n"

"}");

ASSERT_EQUALS("", errout.str());

check("void foo(char* p) {\n"

" if (!p) p = buf;\n"

" *p = 0;\n"

"}");

ASSERT_EQUALS("", errout.str());

check("void foo(char* p) {\n"

" if (!p) p = buf;\n"

" do_something(p);\n"

"}");

ASSERT_EQUALS("", errout.str());

check("void foo(char* p) {\n"

" while (!p) p = buf;\n"

"}");

ASSERT_EQUALS("", errout.str());

check("void foo(char* p) {\n"

" p = 0;\n"

" asm(\"somecmd\");\n"

"}");

ASSERT_EQUALS("", errout.str());

check("void foo(Foo* p) {\n"

" p = 0;\n"

"}");

ASSERT_EQUALS("[test.cpp:2]: (warning) Assignment of function parameter has no effect outside the function. Did you forget dereferencing it?\n", errout.str());

check("class Foo {};\n"

"void foo(Foo p) {\n"

" p = 0;\n"

"}");

ASSERT_EQUALS("[test.cpp:3]: (style) Assignment of function parameter has no effect outside the function.\n", errout.str());

check("void foo(Foo p) {\n"

" p = 0;\n"

"}");

ASSERT_EQUALS("", errout.str());

check("void foo(int& p) {\n"

" p = 0;\n"

"}");

ASSERT_EQUALS("", errout.str());

check("double foo(double d) {\n" // #5005

" int i = d;\n"

" d = i;\n"

" return d;"

"}",false);

ASSERT_EQUALS("", errout.str());

check("void foo(int* ptr) {\n" // #4793

" ptr++;\n"

"}");

ASSERT_EQUALS("[test.cpp:2]: (warning) Assignment of function parameter has no effect outside the function. Did you forget dereferencing it?\n", errout.str());

check("void foo(int* ptr) {\n" // #3177

" --ptr;\n"

"}");

ASSERT_EQUALS("[test.cpp:2]: (warning) Assignment of function parameter has no effect outside the function. Did you forget dereferencing it?\n", errout.str());

check("void foo(struct S* const x) {\n" // #7839

" ++x->n;\n"

"}");

ASSERT_EQUALS("", errout.str());

}

void testautovar11() { // #4641 - fp, assign local struct member address to function parameter

check("struct A {\n"

" char (*data)[10];\n"

"};\n"

"void foo(char** p) {\n"

" struct A a = bar();\n"

" *p = &(*a.data)[0];\n"

"}");

ASSERT_EQUALS("", errout.str());

check("struct A {\n"

" char data[10];\n"

"};\n"

"void foo(char** p) {\n"

" struct A a = bar();\n"

" *p = &a.data[0];\n"

"}");

ASSERT_EQUALS("[test.cpp:6]: (error) Address of local auto-variable assigned to a function parameter.\n", errout.str());

check("void f(char **out) {\n"

" struct S *p = glob;\n"

" *out = &p->data;\n"

"}");

ASSERT_EQUALS("", errout.str());

// #4998

check("void f(s8**out) {\n"

" s8 *p;\n" // <- p is pointer => no error

" *out = &p[1];\n"

"}");

ASSERT_EQUALS("", errout.str());

check("void f(s8**out) {\n"

" s8 p[10];\n" // <- p is array => error

" *out = &p[1];\n"

"}");

ASSERT_EQUALS("[test.cpp:3]: (error) Address of local auto-variable assigned to a function parameter.\n", errout.str());

}

void testautovar12() { // Ticket #5024, #5050 - Crash on invalid input

ASSERT_THROW(check("void f(int* a) { a = }"), InternalError);

check("struct custom_type { custom_type(int) {} };\n"

"void func(int) {}\n"

"int var;\n"

"void init() { func(var); }\n"

"UNKNOWN_MACRO_EXPANDING_TO_SIGNATURE { custom_type a(var); }");

}

void testautovar13() { // Ticket #5537

check("class FileManager {\n"

" FileManager() : UniqueRealDirs(*new UniqueDirContainer())\n"

" {}\n"

" ~FileManager() {\n"

" delete &UniqueRealDirs;\n"

" }\n"

"};\n");

}

void testautovar14() { // Ticket #4776

check("void f(int x) {\n"

"label:"

" if (x>0) {\n"

" x = x >> 1;\n"

" goto label;\n"

" }\n"

"}");

ASSERT_EQUALS("", errout.str());

}

void testautovar15() { // Ticket #6538

check("static const float4 darkOutline(0.05f, 0.05f, 0.05f, 0.95f);\n"

"static const float darkLuminosity = 0.05 +\n"

" 0.0722f * math::powf(darkOutline[2], 2.2);\n"

"const float4* ChooseOutlineColor(const float4& textColor) {\n"

" const float lumdiff = something;\n"

" if (lumdiff > 5.0f)\n"

" return &darkOutline;\n"

" return 0;\n"

"}", false);

ASSERT_EQUALS("", errout.str());

}

void testautovar16() { // Ticket #8114

check("void f(const void* ptr, bool* result) {\n"

" int dummy;\n"

" *result = (&dummy < ptr);\n"

"}");

ASSERT_EQUALS("", errout.str());

}

void testautovar_array1() {

check("void func1(int* arr[2])\n"

"{\n"

" int num=2;"

" arr[0]=&num;\n"

"}");

ASSERT_EQUALS("[test.cpp:3]: (error) Address of local auto-variable assigned to a function parameter.\n", errout.str());

}

void testautovar_array2() {

check("class Fred {\n"

" void func1(int* arr[2]);\n"

"}\n"

"void Fred::func1(int* arr[2])\n"

"{\n"

" int num=2;"

" arr[0]=&num;\n"

"}");

ASSERT_EQUALS("[test.cpp:6]: (error) Address of local auto-variable assigned to a function parameter.\n", errout.str());

}

void testautovar_normal() {

check("void f(XmDestinationCallbackStruct *ds)\n"

"{\n"

" XPoint DropPoint;\n"

" ds->location_data = (XtPointer *)&DropPoint;\n"

"}");

ASSERT_EQUALS("[test.cpp:4]: (error) Address of local auto-variable assigned to a function parameter.\n", errout.str());

}

void testautovar_ptrptr() { // #6596

check("void remove_duplicate_matches (char **matches) {\n"

" char dead_slot;\n"

" matches[0] = (char *)&dead_slot;\n"

"}");

ASSERT_EQUALS("[test.cpp:3]: (error) Address of local auto-variable assigned to a function parameter.\n", errout.str());

}

void testautovar_return1() {

check("int* func1()\n"

"{\n"

" int num=2;"

" return &num;"

"}");

ASSERT_EQUALS("[test.cpp:3] -> [test.cpp:3] -> [test.cpp:3]: (error) Returning pointer to local variable 'num' that will be invalid when returning.\n", errout.str());

}

void testautovar_return2() {

check("class Fred {\n"

" int* func1();\n"

"}\n"

"int* Fred::func1()\n"

"{\n"

" int num=2;"

" return &num;"

"}");

ASSERT_EQUALS("[test.cpp:6] -> [test.cpp:6] -> [test.cpp:6]: (error) Returning pointer to local variable 'num' that will be invalid when returning.\n", errout.str());

}

void testautovar_return3() {

// #2975 - FP

check("void** f()\n"

"{\n"

" void *&value = tls[id];"

" return &value;"

"}");

ASSERT_EQUALS("", errout.str());

}

void testautovar_return4() {

// #8058 - FP ignore return in lambda

check("void foo() {\n"

" int cond2;\n"

" dostuff([&cond2]() { return &cond2; });\n"

"}");

ASSERT_EQUALS("", errout.str());

}

void testautovar_extern() {

check("struct foo *f()\n"

"{\n"

" extern struct foo f;\n"

" return &f;\n"

"}");

ASSERT_EQUALS("", errout.str());

}

void testinvaliddealloc() {

check("void func1() {\n"

" char tmp1[256];\n"

" free(tmp1);\n"

" char tmp2[256];\n"

" delete tmp2;\n"

" char tmp3[256];\n"

" delete tmp3;\n"

" char tmp4[256];\n"

" delete[] (tmp4);\n"

" char tmp5[256];\n"

" delete[] tmp5;\n"

"}");

ASSERT_EQUALS("[test.cpp:3]: (error) Deallocation of an auto-variable results in undefined behaviour.\n"

"[test.cpp:5]: (error) Deallocation of an auto-variable results in undefined behaviour.\n"

"[test.cpp:7]: (error) Deallocation of an auto-variable results in undefined behaviour.\n"

"[test.cpp:9]: (error) Deallocation of an auto-variable results in undefined behaviour.\n"

"[test.cpp:11]: (error) Deallocation of an auto-variable results in undefined behaviour.\n", errout.str());

check("void func1() {\n"

" char* tmp1[256];\n"

" init(tmp1);\n"

" delete tmp1[34];\n"

"}");

ASSERT_EQUALS("", errout.str());

check("void func1() {\n"

" static char tmp1[256];\n"

" char *p = tmp1;\n"

" free(p);\n"

"}");

ASSERT_EQUALS("[test.cpp:4]: (error) Deallocation of an static variable (tmp1) results in undefined behaviour.\n", errout.str());

check("char tmp1[256];\n"

"void func1() {\n"

" char *p; if (x) p = tmp1;\n"

" free(p);\n"

"}");

ASSERT_EQUALS("[test.cpp:4]: (error) Deallocation of an global variable (tmp1) results in undefined behaviour.\n", errout.str());

check("void f()\n"

"{\n"

" char psz_title[10];\n"

" {\n"

" char *psz_title = 0;\n"

" abc(0, psz_title);\n"

" free(psz_title);\n"

" }\n"

"}");

ASSERT_EQUALS("", errout.str());

// #2298 new check: passing stack-address to free()

check("int main() {\n"

" int *p = malloc(4);\n"

" free(&p);\n"

" return 0;\n"

"}");

ASSERT_EQUALS("[test.cpp:3]: (error) Deallocation of an auto-variable results in undefined behaviour.\n", errout.str());

check("int main() {\n"

" int i;\n"

" free(&i);\n"

" return 0;\n"

"}");

ASSERT_EQUALS("[test.cpp:3]: (error) Deallocation of an auto-variable results in undefined behaviour.\n", errout.str());

// #5732

check("int main() {\n"

" long (*pKoeff)[256] = new long[9][256];\n"

" delete[] pKoeff;\n"

"}");

ASSERT_EQUALS("", errout.str());

check("int main() {\n"

" long *pKoeff[256];\n"

" delete[] pKoeff;\n"

"}");

ASSERT_EQUALS("[test.cpp:3]: (error) Deallocation of an auto-variable results in undefined behaviour.\n", errout.str());

check("int main() {\n"

" long *pKoeff[256];\n"

" free (pKoeff);\n"

"}");

ASSERT_EQUALS("[test.cpp:3]: (error) Deallocation of an auto-variable results in undefined behaviour.\n", errout.str());

check("void foo() {\n"

" const intPtr& intref = Getter();\n"

" delete intref;\n"

"}");

ASSERT_EQUALS("", errout.str());

check("void test() {\n"

" MyObj& obj = *new MyObj;\n"

" delete &obj;\n"

"}");

ASSERT_EQUALS("", errout.str());

// #6506

check("struct F {\n"

" void free(void*) {}\n"

"};\n"

"void foo() {\n"

" char c1[1];\n"

" F().free(c1);\n"

" char *c2 = 0;\n"

" F().free(&c2);\n"

"}");

ASSERT_EQUALS("", errout.str());

check("class foo {\n"

" void free(void* );\n"

" void someMethod() {\n"

" char **dst_copy = NULL;\n"

" free(&dst_copy);\n"

" }\n"

"};");

ASSERT_EQUALS("", errout.str());

// #6551

check("bool foo( ) {\n"

" SwTxtFld * pTxtFld = GetFldTxtAttrAt();\n"

" delete static_cast<SwFmtFld*>(&pTxtFld->GetAttr());\n"

"}");

ASSERT_EQUALS("", errout.str());

// #8910

check("void f() {\n"

" char stack[512];\n"

" RGNDATA *data;\n"

" if (data_size > sizeof (stack)) data = malloc (data_size);\n"

" else data = (RGNDATA *)stack;\n"

" if ((char *)data != stack) free (data);\n"

"}\n");

ASSERT_EQUALS("", errout.str());

// #8923

check("void f(char **args1, char *args2[]) {\n"

" free((char **)args1);\n"

" free((char **)args2);\n"

"}");

ASSERT_EQUALS("", errout.str());

}

void testinvaliddealloc_C() {

// #5691

check("void svn_repos_dir_delta2() {\n"

" struct context c;\n"

" SVN_ERR(delete(&c, root_baton, src_entry, pool));\n"

"}\n", false, "test.c");

ASSERT_EQUALS("", errout.str());

}

void testassign1() { // Ticket #1819

check("void f(EventPtr *eventP, ActionPtr **actionsP) {\n"

" EventPtr event = *eventP;\n"

" *actionsP = &event->actions;\n"

"}");

ASSERT_EQUALS("", errout.str());

}

void testassign2() { // Ticket #2765

check("static void function(unsigned long **datap) {\n"

" struct my_s *mr = global_structure_pointer;\n"

" *datap = &mr->value;\n"

"}");

ASSERT_EQUALS("", errout.str());

}

void assignAddressOfLocalArrayToGlobalPointer() {

check("int *p;\n"

"void f() {\n"

" int x[10];\n"

" p = x;\n"

"}");

ASSERT_EQUALS("[test.cpp:4] -> [test.cpp:3] -> [test.cpp:4]: (error) Non-local variable 'p' will use pointer to local variable 'x'.\n", errout.str());

check("int *p;\n"

"void f() {\n"

" int x[10];\n"

" p = x;\n"

" p = 0;\n"

"}");

ASSERT_EQUALS("", errout.str());

}

void assignAddressOfLocalVariableToGlobalPointer() {

check("int *p;\n"

"void f() {\n"

" int x;\n"

" p = &x;\n"

"}");

ASSERT_EQUALS("[test.cpp:4] -> [test.cpp:3] -> [test.cpp:4]: (error) Non-local variable 'p' will use pointer to local variable 'x'.\n", errout.str());

check("int *p;\n"

"void f() {\n"

" int x;\n"

" p = &x;\n"

" p = 0;\n"

"}");

ASSERT_EQUALS("", errout.str());

}

void assignAddressOfLocalVariableToMemberVariable() {

check("struct A {\n"

" void f() {\n"

" int x;\n"

" ptr = &x;\n"

" }\n"

" int *ptr;\n"

"};\n");

ASSERT_EQUALS("[test.cpp:4] -> [test.cpp:3] -> [test.cpp:4]: (error) Non-local variable 'ptr' will use pointer to local variable 'x'.\n", errout.str());

check("struct A {\n"

" void f() {\n"

" int x;\n"

" ptr = &x;\n"

" ptr = 0;\n"

" }\n"

" int *ptr;\n"

"};\n");

ASSERT_EQUALS("", errout.str());

}

void returnLocalVariable1() {

check("char *foo()\n"

"{\n"

" char str[100] = {0};\n"

" return str;\n"

"}");

ASSERT_EQUALS(

"[test.cpp:4] -> [test.cpp:3] -> [test.cpp:4]: (error) Returning pointer to local variable 'str' that will be invalid when returning.\n",

errout.str());

check("char *foo()\n" // use ValueFlow

"{\n"

" char str[100] = {0};\n"

" char *p = str;\n"

" return p;\n"

"}");

ASSERT_EQUALS(

"[test.cpp:4] -> [test.cpp:3] -> [test.cpp:5]: (error) Returning pointer to local variable 'str' that will be invalid when returning.\n",

errout.str());

check("class Fred {\n"

" char *foo();\n"

"};\n"

"char *Fred::foo()\n"

"{\n"

" char str[100] = {0};\n"

" return str;\n"

"}");

ASSERT_EQUALS(

"[test.cpp:7] -> [test.cpp:6] -> [test.cpp:7]: (error) Returning pointer to local variable 'str' that will be invalid when returning.\n",

errout.str());

check("char * format_reg(char *outbuffer_start) {\n"

" return outbuffer_start;\n"

"}\n"

"void print_with_operands() {\n"

" char temp[42];\n"

" char *tp = temp;\n"

" tp = format_reg(tp);\n"

"}");

ASSERT_EQUALS("", errout.str());

}

void returnLocalVariable2() {

check("std::string foo()\n"

"{\n"

" char str[100] = {0};\n"

" return str;\n"

"}");

ASSERT_EQUALS("", errout.str());

check("class Fred {\n"

" std::string foo();\n"

"};\n"

"std::string Fred::foo()\n"

"{\n"

" char str[100] = {0};\n"

" return str;\n"

"}");

ASSERT_EQUALS("", errout.str());

}

void returnLocalVariable3() { // &x[..]

// #3030

check("char *foo() {\n"

" char q[] = \"AAAAAAAAAAAA\";\n"

" return &q[1];\n"

"}");

ASSERT_EQUALS("[test.cpp:3] -> [test.cpp:2] -> [test.cpp:3]: (error) Returning pointer to local variable 'q' that will be invalid when returning.\n", errout.str());

check("char *foo()\n"

"{\n"

" static char q[] = \"AAAAAAAAAAAA\";\n"

" return &q[1];\n"

"}");

ASSERT_EQUALS("", errout.str());

check("char *foo()\n"

"{\n"

"char q[] = \"AAAAAAAAAAAA\";\n"

"char *p;\n"

"p = &q[1];\n"

"return p;\n"

"}\n");

ASSERT_EQUALS("[test.cpp:5] -> [test.cpp:3] -> [test.cpp:6]: (error) Returning pointer to local variable 'q' that will be invalid when returning.\n", errout.str());

}

void returnLocalVariable4() { // x+y

check("char *foo() {\n"

" char x[10] = {0};\n"

" return x+5;\n"

"}");

ASSERT_EQUALS(

"[test.cpp:3] -> [test.cpp:2] -> [test.cpp:3]: (error) Returning pointer to local variable 'x' that will be invalid when returning.\n",

errout.str());

check("char *foo(int y) {\n"

" char x[10] = {0};\n"

" return (x+8)-y;\n"

"}");

ASSERT_EQUALS(

"[test.cpp:3] -> [test.cpp:2] -> [test.cpp:3]: (error) Returning pointer to local variable 'x' that will be invalid when returning.\n",

errout.str());

}

void returnLocalVariable5() { // cast

check("char *foo() {\n"

" int x[10] = {0};\n"

" return (char *)x;\n"

"}");

ASSERT_EQUALS(

"[test.cpp:3] -> [test.cpp:2] -> [test.cpp:3]: (error) Returning pointer to local variable 'x' that will be invalid when returning.\n",

errout.str());

}

void returnLocalVariable6() { // valueflow

check("int *foo() {\n"

" int x = 123;\n"

" int p = &x;\n"

" return p;\n"

"}");

ASSERT_EQUALS("[test.cpp:3] -> [test.cpp:2] -> [test.cpp:4]: (error) Returning object that points to local variable 'x' that will be invalid when returning.\n", errout.str());

}

void returnReference1() {

check("int &foo()\n"

"{\n"

" int s = 0;\n"

" int& x = s;\n"

" return x;\n"

"}\n");

ASSERT_EQUALS("[test.cpp:4] -> [test.cpp:5]: (error) Reference to local variable returned.\n", errout.str());

check("std::string &foo()\n"

"{\n"

" std::string s;\n"

" return s;\n"

"}");

ASSERT_EQUALS("[test.cpp:4]: (error) Reference to local variable returned.\n", errout.str());

check("std::vector<int> &foo()\n"

"{\n"

" std::vector<int> v;\n"

" return v;\n"

"}");

ASSERT_EQUALS("[test.cpp:4]: (error) Reference to local variable returned.\n", errout.str());

check("std::vector<int> &foo()\n"

"{\n"

" static std::vector<int> v;\n"

" return v;\n"

"}");

ASSERT_EQUALS("", errout.str());

check("std::vector<int> &foo()\n"

"{\n"

" thread_local std::vector<int> v;\n"

" return v;\n"

"}");

ASSERT_EQUALS("", errout.str());

check("std::string hello()\n"

"{\n"

" return \"hello\";\n"

"}\n"

"\n"

"std::string &f()\n"

"{\n"

" return hello();\n"

"}");

ASSERT_EQUALS("[test.cpp:8]: (error) Reference to temporary returned.\n", errout.str());

// make sure scope is used in function lookup

check("class Fred {\n"

" std::string hello() {\n"

" return std::string();\n"

" }\n"

"};\n"

"std::string &f() {\n"

" return hello();\n"

"}");

ASSERT_EQUALS("", errout.str());

check("std::string hello() {\n"

" return std::string();\n"

"}\n"

"\n"

"std::string &f() {\n"

" return hello();\n"

"}");

ASSERT_EQUALS("[test.cpp:6]: (error) Reference to temporary returned.\n", errout.str());

check("std::string hello() {\n"

" return \"foo\";\n"

"}\n"

"\n"

"std::string &f() {\n"

" return hello().substr(1);\n"

"}");

ASSERT_EQUALS("", errout.str());

check("class Foo;\n"

"Foo hello() {\n"

" return Foo();\n"

"}\n"

"\n"

"Foo& f() {\n"

" return hello();\n"

"}");

ASSERT_EQUALS("[test.cpp:7]: (error) Reference to temporary returned.\n", errout.str());

// make sure function overloads are handled properly

check("class Foo;\n"

"Foo & hello(bool) {\n"

" static Foo foo;\n"

" return foo;\n"

"}\n"

"Foo hello() {\n"

" return Foo();\n"

"}\n"

"\n"

"Foo& f() {\n"

" return hello(true);\n"

"}");