/*

* Cppcheck - A tool for static C/C++ code analysis

* Copyright (C) 2007-2026 Cppcheck team.

*

* This program is free software: you can redistribute it and/or modify

* it under the terms of the GNU General Public License as published by

* the Free Software Foundation, either version 3 of the License, or

* (at your option) any later version.

*

* This program is distributed in the hope that it will be useful,

* but WITHOUT ANY WARRANTY; without even the implied warranty of

* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

* GNU General Public License for more details.

*

* You should have received a copy of the GNU General Public License

* along with this program. If not, see <http://www.gnu.org/licenses/>.

*/

#include "checkautovariables.h"

#include "errortypes.h"

#include "fixture.h"

#include "helpers.h"

#include "settings.h"

#include <cstddef>

class TestAutoVariables : public TestFixture {

public:

TestAutoVariables() : TestFixture("TestAutoVariables") {}

private:

const Settings settings = settingsBuilder().severity(Severity::warning).severity(Severity::style).library("std.cfg").library("qt.cfg").build();

const Settings settings_i = settingsBuilder(settings).certainty(Certainty::inconclusive).build();

struct CheckOptions

{

bool inconclusive = true;

bool cpp = true;

};

#define check(...) check_(__FILE__, __LINE__, __VA_ARGS__)

template<size_t size>

void check_(const char* file, int line, const char (&code)[size], const CheckOptions& options = make_default_obj()) {

const Settings &settings1 = options.inconclusive ? settings_i : settings;

// Tokenize..

SimpleTokenizer tokenizer(settings1, *this, options.cpp);

ASSERT_LOC(tokenizer.tokenize(code), file, line);

CheckAutoVariables check;

runChecks(check, tokenizer, *this);

}

void run() override {

mNewTemplate = true;

TEST_CASE(testautovar1);

TEST_CASE(testautovar2);

TEST_CASE(testautovar3); // ticket #2925

TEST_CASE(testautovar4); // ticket #2928

TEST_CASE(testautovar5); // ticket #2926

TEST_CASE(testautovar6); // ticket #2931

TEST_CASE(testautovar7); // ticket #3066

TEST_CASE(testautovar8);

TEST_CASE(testautovar9);

TEST_CASE(testautovar10); // ticket #2930 - void f(char *p) { p = '\0'; }

TEST_CASE(testautovar11); // ticket #4641 - fp, assign local struct member address to function parameter

TEST_CASE(testautovar12); // ticket #5024 - crash

TEST_CASE(testautovar13); // ticket #5537 - crash

TEST_CASE(testautovar14); // ticket #4776 - assignment of function parameter, goto

TEST_CASE(testautovar15); // ticket #6538

TEST_CASE(testautovar16); // ticket #8114

TEST_CASE(testautovar17);

TEST_CASE(testautovar18);

TEST_CASE(testautovar_array1);

TEST_CASE(testautovar_array2);

TEST_CASE(testautovar_array3);

TEST_CASE(testautovar_normal); // "normal" token list that does not remove casts etc

TEST_CASE(testautovar_ptrptr); // ticket #6956

TEST_CASE(testautovar_return1);

TEST_CASE(testautovar_return2);

TEST_CASE(testautovar_return3);

TEST_CASE(testautovar_return4);

TEST_CASE(testautovar_return5);

TEST_CASE(testautovar_return6);

TEST_CASE(testautovar_extern);

TEST_CASE(testautovar_reassigned);

TEST_CASE(testinvaliddealloc);

TEST_CASE(testinvaliddealloc_input); // Ticket #10600

TEST_CASE(testinvaliddealloc_string);

TEST_CASE(testinvaliddealloc_C);

TEST_CASE(testassign1); // Ticket #1819

TEST_CASE(testassign2); // Ticket #2765

TEST_CASE(assignAddressOfLocalArrayToGlobalPointer);

TEST_CASE(assignAddressOfLocalVariableToGlobalPointer);

TEST_CASE(assignAddressOfLocalVariableToMemberVariable);

TEST_CASE(returnLocalVariable1);

TEST_CASE(returnLocalVariable2);

TEST_CASE(returnLocalVariable3); // &x[0]

TEST_CASE(returnLocalVariable4); // x+y

TEST_CASE(returnLocalVariable5); // cast

TEST_CASE(returnLocalVariable6); // valueflow

// return reference..

TEST_CASE(returnReference1);

TEST_CASE(returnReference2);

TEST_CASE(returnReference3);

TEST_CASE(returnReference4);

TEST_CASE(returnReference5);

TEST_CASE(returnReference6);

TEST_CASE(returnReference7);

TEST_CASE(returnReference8);

TEST_CASE(returnReference9);

TEST_CASE(returnReference10);

TEST_CASE(returnReference11);

TEST_CASE(returnReference12);

TEST_CASE(returnReference13);

TEST_CASE(returnReference14);

TEST_CASE(returnReference15); // #9432

TEST_CASE(returnReference16); // #9433

TEST_CASE(returnReference16); // #9433

TEST_CASE(returnReference17); // #9461

TEST_CASE(returnReference18); // #9482

TEST_CASE(returnReference19); // #9597

TEST_CASE(returnReference20); // #9536

TEST_CASE(returnReference21); // #9530

TEST_CASE(returnReference22);

TEST_CASE(returnReference23);

TEST_CASE(returnReference24); // #10098

TEST_CASE(returnReference25); // #10983

TEST_CASE(returnReference26);

TEST_CASE(returnReference27);

TEST_CASE(returnReference28);

TEST_CASE(returnReference29);

TEST_CASE(returnReferenceFunction);

TEST_CASE(returnReferenceContainer);

TEST_CASE(returnReferenceLiteral);

TEST_CASE(returnReferenceCalculation);

TEST_CASE(returnReferenceLambda);

TEST_CASE(returnReferenceInnerScope);

TEST_CASE(returnReferenceRecursive);

TEST_CASE(extendedLifetime);

TEST_CASE(danglingReference);

TEST_CASE(danglingTempReference);

// global namespace

TEST_CASE(testglobalnamespace);

TEST_CASE(returnParameterAddress);

TEST_CASE(testconstructor); // ticket #5478 - crash

TEST_CASE(variableIsUsedInScope); // ticket #5599 crash in variableIsUsedInScope()

TEST_CASE(danglingLifetimeLambda);

TEST_CASE(danglingLifetimeContainer);

TEST_CASE(danglingLifetimeContainerView);

TEST_CASE(danglingLifetimeUniquePtr);

TEST_CASE(danglingLifetime);

TEST_CASE(danglingLifetimeFunction);

TEST_CASE(danglingLifetimeUserConstructor);

TEST_CASE(danglingLifetimeAggregateConstructor);

TEST_CASE(danglingLifetimeInitList);

TEST_CASE(danglingLifetimeImplicitConversion);

TEST_CASE(danglingTemporaryLifetime);

TEST_CASE(danglingLifetimeBorrowedMembers);

TEST_CASE(danglingLifetimeClassMemberFunctions);

TEST_CASE(invalidLifetime);

TEST_CASE(deadPointer);

TEST_CASE(splitNamespaceAuto); // crash #10473

TEST_CASE(incompleteTypeArray);

}

void testautovar1() {

check("void func1(int **res)\n"

"{\n"

" int num = 2;\n"

" *res = &num;\n"

"}\n");

ASSERT_EQUALS("[test.cpp:4:5]: (error) Address of local auto-variable assigned to a function parameter. [autoVariables]\n", errout_str());

check("void func1(int **res)\n"

"{\n"

" int num = 2;\n"

" res = &num;\n"

"}\n");

ASSERT_EQUALS("[test.cpp:4:5]: (warning) Assignment of function parameter has no effect outside the function. Did you forget dereferencing it? [uselessAssignmentPtrArg]\n", errout_str());

check("void func1(int **res)\n"

"{\n"

" int num = 2;\n"

" foo.res = &num;\n"

"}\n");

ASSERT_EQUALS("", errout_str());

}

void testautovar2() {

check("class Fred {\n"

" void func1(int **res);\n"

"}\n"

"void Fred::func1(int **res)\n"

"{\n"

" int num = 2;\n"

" *res = &num;\n"

"}\n");

ASSERT_EQUALS("[test.cpp:7:5]: (error) Address of local auto-variable assigned to a function parameter. [autoVariables]\n", errout_str());

check("class Fred {\n"

" void func1(int **res);\n"

"}\n"

"void Fred::func1(int **res)\n"

"{\n"

" int num = 2;\n"

" res = &num;\n"

"}\n");

ASSERT_EQUALS("[test.cpp:7:5]: (warning) Assignment of function parameter has no effect outside the function. Did you forget dereferencing it? [uselessAssignmentPtrArg]\n", errout_str());

check("class Fred {\n"

" void func1(int **res);\n"

"}\n"

"void Fred::func1(int **res)\n"

"{\n"

" int num = 2;\n"

" foo.res = &num;\n"

"}\n");

ASSERT_EQUALS("", errout_str());

}

void testautovar3() { // ticket #2925

check("void foo(int **p)\n"

"{\n"

" int x[100];\n"

" *p = x;\n"

"}\n");

ASSERT_EQUALS("[test.cpp:4:5]: (error) Address of local auto-variable assigned to a function parameter. [autoVariables]\n", errout_str());

}

void testautovar4() { // ticket #2928

check("void foo(int **p)\n"

"{\n"

" static int x[100];\n"

" *p = x;\n"

"}\n");

ASSERT_EQUALS("", errout_str());

}

void testautovar5() { // ticket #2926

check("void foo(struct AB *ab)\n"

"{\n"

" char a;\n"

" ab->a = &a;\n"

"}\n");

ASSERT_EQUALS("[test.cpp:4:5]: (error, inconclusive) Address of local auto-variable assigned to a function parameter. [autoVariables]\n", errout_str());

}

void testautovar6() { // ticket #2931

check("void foo(struct X *x)\n"

"{\n"

" char a[10];\n"

" x->str = a;\n"

"}\n", dinit(CheckOptions, $.inconclusive = false));

ASSERT_EQUALS("", errout_str());

check("void foo(struct X *x)\n"

"{\n"

" char a[10];\n"

" x->str = a;\n"

"}\n");

ASSERT_EQUALS("[test.cpp:4:5]: (error, inconclusive) Address of local auto-variable assigned to a function parameter. [autoVariables]\n", errout_str());

}

void testautovar7() { // ticket #3066

check("struct txt_scrollpane_s * TXT_NewScrollPane(struct txt_widget_s * target)\n"

"{\n"

" struct txt_scrollpane_s * scrollpane;\n"

" target->parent = &scrollpane->widget;\n"

" return scrollpane;\n"

"}\n", dinit(CheckOptions, $.inconclusive = false));

ASSERT_EQUALS("", errout_str());

}

void testautovar8() {

check("void foo(int*& p) {\n"

" int i = 0;\n"

" p = &i;\n"

"}\n", dinit(CheckOptions, $.inconclusive = false));

ASSERT_EQUALS("[test.cpp:3:5]: (error) Address of local auto-variable assigned to a function parameter. [autoVariables]\n", errout_str());

check("void foo(std::string& s) {\n"

" s = foo;\n"

"}\n", dinit(CheckOptions, $.inconclusive = false));

ASSERT_EQUALS("", errout_str());

}

void testautovar9() {

check("struct FN {int i;};\n"

"struct FP {FN* f};\n"

"void foo(int*& p, FN* p_fp) {\n"

" FN fn;\n"

" FP fp;\n"

" p = &fn.i;\n"

"}\n", dinit(CheckOptions, $.inconclusive = false));

ASSERT_EQUALS("[test.cpp:6:5]: (error) Address of local auto-variable assigned to a function parameter. [autoVariables]\n", errout_str());

check("struct FN {int i;};\n"

"struct FP {FN* f};\n"

"void foo(int*& p, FN* p_fp) {\n"

" FN fn;\n"

" FP fp;\n"

" p = &p_fp->i;\n"

"}\n", dinit(CheckOptions, $.inconclusive = false));

ASSERT_EQUALS("", errout_str());

check("struct FN {int i;};\n"

"struct FP {FN* f};\n"

"void foo(int*& p, FN* p_fp) {\n"

" FN fn;\n"

" FP fp;\n"

" p = &fp.f->i;\n"

"}\n", dinit(CheckOptions, $.inconclusive = false));

ASSERT_EQUALS("", errout_str());

}

void testautovar10() { // #2930 - assignment of function parameter

check("void foo(char* p) {\n"

" p = 0;\n"

"}\n");

ASSERT_EQUALS("[test.cpp:2:5]: (warning) Assignment of function parameter has no effect outside the function. Did you forget dereferencing it? [uselessAssignmentPtrArg]\n", errout_str());

check("void foo(int b) {\n"

" b = foo(b);\n"

"}\n");

ASSERT_EQUALS("[test.cpp:2:5]: (style) Assignment of function parameter has no effect outside the function. [uselessAssignmentArg]\n", errout_str());

check("void foo(int b) {\n"

" b += 1;\n"

"}\n");

ASSERT_EQUALS("[test.cpp:2:5]: (style) Assignment of function parameter has no effect outside the function. [uselessAssignmentArg]\n", errout_str());

check("void foo(std::string s) {\n"

" s = foo(b);\n"

"}\n");

ASSERT_EQUALS("[test.cpp:2:5]: (style) Assignment of function parameter has no effect outside the function. [uselessAssignmentArg]\n", errout_str());

check("void foo(char* p) {\n" // don't warn for self assignment, there is another warning for this

" p = p;\n"

"}\n");

ASSERT_EQUALS("", errout_str());

check("void foo(char* p) {\n"

" if (!p) p = buf;\n"

" *p = 0;\n"

"}\n");

ASSERT_EQUALS("", errout_str());

check("void foo(char* p) {\n"

" if (!p) p = buf;\n"

" do_something(p);\n"

"}\n");

ASSERT_EQUALS("", errout_str());

check("void foo(char* p) {\n"

" while (!p) p = buf;\n"

"}\n");

ASSERT_EQUALS("", errout_str());

check("void foo(char* p) {\n"

" p = 0;\n"

" asm(\"somecmd\");\n"

"}\n");

ASSERT_EQUALS("", errout_str());

check("void foo(Foo* p) {\n"

" p = 0;\n"

"}\n");

ASSERT_EQUALS("[test.cpp:2:5]: (warning) Assignment of function parameter has no effect outside the function. Did you forget dereferencing it? [uselessAssignmentPtrArg]\n", errout_str());

check("class Foo {};\n"

"void foo(Foo p) {\n"

" p = 0;\n"

"}\n");

ASSERT_EQUALS("[test.cpp:3:5]: (style) Assignment of function parameter has no effect outside the function. [uselessAssignmentArg]\n", errout_str());

check("void foo(Foo p) {\n"

" p = 0;\n"

"}\n");

ASSERT_EQUALS("", errout_str());

check("void foo(int& p) {\n"

" p = 0;\n"

"}\n");

ASSERT_EQUALS("", errout_str());

check("double foo(double d) {\n" // #5005

" int i = d;\n"

" d = i;\n"

" return d;\n"

"}\n",dinit(CheckOptions, $.inconclusive = false));

ASSERT_EQUALS("", errout_str());

check("void foo(int* ptr) {\n" // #4793

" ptr++;\n"

"}\n");

ASSERT_EQUALS("[test.cpp:2:5]: (warning) Assignment of function parameter has no effect outside the function. Did you forget dereferencing it? [uselessAssignmentPtrArg]\n", errout_str());

check("void foo(int* ptr) {\n" // #3177

" --ptr;\n"

"}\n");

ASSERT_EQUALS("[test.cpp:2:7]: (warning) Assignment of function parameter has no effect outside the function. Did you forget dereferencing it? [uselessAssignmentPtrArg]\n", errout_str());

check("void foo(struct S* const x) {\n" // #7839

" ++x->n;\n"

"}\n");

ASSERT_EQUALS("", errout_str());

}

void testautovar11() { // #4641 - fp, assign local struct member address to function parameter

check("struct A {\n"

" char (*data)[10];\n"

"};\n"

"void foo(char** p) {\n"

" struct A a = bar();\n"

" *p = &(*a.data)[0];\n"

"}\n");

ASSERT_EQUALS("", errout_str());

check("struct A {\n"

" char data[10];\n"

"};\n"

"void foo(char** p) {\n"

" struct A a = bar();\n"

" *p = &a.data[0];\n"

"}\n");

ASSERT_EQUALS("[test.cpp:6:5]: (error) Address of local auto-variable assigned to a function parameter. [autoVariables]\n", errout_str());

check("void f(char **out) {\n"

" struct S *p = glob;\n"

" *out = &p->data;\n"

"}\n");

ASSERT_EQUALS("", errout_str());

// #4998

check("void f(s8**out) {\n"

" s8 *p;\n" // <- p is pointer => no error

" *out = &p[1];\n"

"}\n");

ASSERT_EQUALS("", errout_str());

check("void f(s8**out) {\n"

" s8 p[10];\n" // <- p is array => error

" *out = &p[1];\n"

"}\n");

ASSERT_EQUALS("[test.cpp:3:3]: (error) Address of local auto-variable assigned to a function parameter. [autoVariables]\n", errout_str());

}

void testautovar12() { // Ticket #5024, #5050 - Crash on invalid input

ASSERT_THROW_INTERNAL(check("void f(int* a) { a = }\n"), SYNTAX);

check("struct custom_type { custom_type(int) {} };\n"

"void func(int) {}\n"

"int var;\n"

"void init() { func(var); }\n"

"UNKNOWN_MACRO_EXPANDING_TO_SIGNATURE { custom_type a(var); }\n");

}

void testautovar13() { // Ticket #5537

check("class FileManager {\n"

" FileManager() : UniqueRealDirs(*new UniqueDirContainer())\n"

" {}\n"

" ~FileManager() {\n"

" delete &UniqueRealDirs;\n"

" }\n"

"};\n");

}

void testautovar14() { // Ticket #4776

check("void f(int x) {\n"

"label:"

" if (x>0) {\n"

" x = x >> 1;\n"

" goto label;\n"

" }\n"

"}\n");

ASSERT_EQUALS("", errout_str());

}

void testautovar15() { // Ticket #6538

check("static const float4 darkOutline(0.05f, 0.05f, 0.05f, 0.95f);\n"

"static const float darkLuminosity = 0.05 +\n"

" 0.0722f * math::powf(darkOutline[2], 2.2);\n"

"const float4* ChooseOutlineColor(const float4& textColor) {\n"

" const float lumdiff = something;\n"

" if (lumdiff > 5.0f)\n"

" return &darkOutline;\n"

" return 0;\n"

"}\n", dinit(CheckOptions, $.inconclusive = false));

ASSERT_EQUALS("", errout_str());

}

void testautovar16() { // Ticket #8114

check("void f(const void* ptr, bool* result) {\n"

" int dummy;\n"

" *result = (&dummy < ptr);\n"

"}\n");

ASSERT_EQUALS("", errout_str());

}

void testautovar17() {

check("struct S { int* p; };\n" // #14257

"int a[10];\n"

"void f(int** q) {\n"

" S s;\n"

" s.p = a;\n"

" *q = &s.p[0];\n"

"}\n");

ASSERT_EQUALS("", errout_str());

}

void testautovar18() {

check("struct S { int* p; };\n"

"void foo(struct S* s) {\n"

" int x;\n"

" s[2].p = &x;\n"

"}\n");

ASSERT_EQUALS("[test.cpp:4:5]: (error) Address of local auto-variable assigned to a function parameter. [autoVariables]\n", errout_str());

}

void testautovar_array1() {

check("void func1(int* arr[2])\n"

"{\n"

" int num=2;"

" arr[0]=&num;\n"

"}\n");

ASSERT_EQUALS("[test.cpp:3:19]: (error) Address of local auto-variable assigned to a function parameter. [autoVariables]\n", errout_str());

}

void testautovar_array2() {

check("class Fred {\n"

" void func1(int* arr[2]);\n"

"}\n"

"void Fred::func1(int* arr[2])\n"

"{\n"

" int num=2;"

" arr[0]=&num;\n"

"}\n");

ASSERT_EQUALS("[test.cpp:6:19]: (error) Address of local auto-variable assigned to a function parameter. [autoVariables]\n", errout_str());

}

void testautovar_array3() {

check("int main(int argc, char* argv[]) {\n" // #11732

" std::string a = \"abc\";\n"

" argv[0] = &a[0];\n"

"}\n");

ASSERT_EQUALS("", errout_str());

check("void f(char* c[]) {\n"

" char a[] = \"abc\";\n"

" c[0] = a;\n"

"}\n"

"void g(char* c[]) {\n"

" std::string a = \"abc\";\n"

" c[0] = a.data();\n"

"}\n");

ASSERT_EQUALS("[test.cpp:3:5]: (error) Address of local auto-variable assigned to a function parameter. [autoVariables]\n"

"[test.cpp:7:5]: (error) Address of local auto-variable assigned to a function parameter. [autoVariables]\n",

errout_str());

check("struct String {\n"

" String& operator=(const char* c) { m = c; return *this; }\n"

" std::string m;\n"

"};\n"

"struct T { String s; };\n"

"void f(T* t) {\n"

" char a[] = \"abc\";\n"

" t->s = &a[0];\n"

"}\n"

"void g(std::string* s) {\n"

" char a[] = \"abc\";\n"

" *s = &a[0];\n"

"}\n");

ASSERT_EQUALS("", errout_str());

check("void f(int* p[]) {\n" // #7167

" int a[4] = { 1, 2, 3 };\n"

" p[0] = a;\n"

"};\n");

ASSERT_EQUALS("[test.cpp:3:5]: (error) Address of local auto-variable assigned to a function parameter. [autoVariables]\n",

errout_str());

}

void testautovar_normal() {

check("void f(XmDestinationCallbackStruct *ds)\n"

"{\n"

" XPoint DropPoint;\n"

" ds->location_data = (XtPointer *)&DropPoint;\n"

"}\n");

ASSERT_EQUALS("[test.cpp:4:5]: (error, inconclusive) Address of local auto-variable assigned to a function parameter. [autoVariables]\n", errout_str());

}

void testautovar_ptrptr() { // #6596

check("void remove_duplicate_matches (char **matches) {\n"

" char dead_slot;\n"

" matches[0] = (char *)&dead_slot;\n"

"}\n");

ASSERT_EQUALS("[test.cpp:3:3]: (error) Address of local auto-variable assigned to a function parameter. [autoVariables]\n", errout_str());

}

void testautovar_return1() {

check("int* func1()\n"

"{\n"

" int num=2;"

" return &num;"

"}\n");

ASSERT_EQUALS("[test.cpp:3:26] -> [test.cpp:3:9] -> [test.cpp:3:26]: (error) Returning pointer to local variable 'num' that will be invalid when returning. [returnDanglingLifetime]\n", errout_str());

}

void testautovar_return2() {

check("class Fred {\n"

" int* func1();\n"

"}\n"

"int* Fred::func1()\n"

"{\n"

" int num=2;"

" return &num;"

"}\n");

ASSERT_EQUALS("[test.cpp:6:26] -> [test.cpp:6:9] -> [test.cpp:6:26]: (error) Returning pointer to local variable 'num' that will be invalid when returning. [returnDanglingLifetime]\n", errout_str());

}

void testautovar_return3() {

// #2975 - FP

check("void** f()\n"

"{\n"

" void *&value = tls[id];"

" return &value;"

"}\n");

ASSERT_EQUALS("", errout_str());

}

void testautovar_return4() {

// #8058 - FP ignore return in lambda

check("void foo() {\n"

" int cond2;\n"

" dostuff([&cond2]() { return &cond2; });\n"

"}\n");

ASSERT_EQUALS("", errout_str());

}

void testautovar_return5() { // #11465

check("struct S {};\n"

"const std::type_info* f() {\n"

" return &typeid(S);\n"

"}\n");

ASSERT_EQUALS("", errout_str());

}

void testautovar_return6() { // #14005

check("struct S;\n"

"struct T { const struct S *s; };\n"

"extern struct T factory();\n"

"const struct S* f() {\n"

" struct T t = factory();\n"

" return &t.s[0];\n"

"}\n");

ASSERT_EQUALS("", errout_str());

check("struct S;\n"

"struct T { std::vector<struct S> v; };\n"

"extern struct T factory();\n"

"const struct S* f() {\n"

" struct T t = factory();\n"

" return &t.v[0];\n"

"}\n");

ASSERT_EQUALS("[test.cpp:6:12] -> [test.cpp:5:14] -> [test.cpp:6:12]: (error) Returning pointer to local variable 't' that will be invalid when returning. [returnDanglingLifetime]\n", errout_str());

}

void testautovar_extern() {

check("struct foo *f()\n"

"{\n"

" extern struct foo f;\n"

" return &f;\n"

"}\n");

ASSERT_EQUALS("", errout_str());

}

void testautovar_reassigned() {

check("void foo(cb* pcb) {\n"

" int root0;\n"

" pcb->root0 = &root0;\n"

" dostuff(pcb);\n"

" pcb->root0 = 0;\n"

"}\n");

ASSERT_EQUALS("", errout_str());

check("void foo(cb* pcb) {\n"

" int root0;\n"

" pcb->root0 = &root0;\n"

" dostuff(pcb);\n"

" if (condition) return;\n" // <- not reassigned => error

" pcb->root0 = 0;\n"

"}\n");

ASSERT_EQUALS("[test.cpp:3:3]: (error, inconclusive) Address of local auto-variable assigned to a function parameter. [autoVariables]\n", errout_str());

check("void foo(cb* pcb) {\n"

" int root0;\n"

" pcb->root0 = &root0;\n"

" dostuff(pcb);\n"

" if (condition)\n"

" pcb->root0 = 0;\n" // <- conditional reassign => error

"}\n");

ASSERT_EQUALS("[test.cpp:3:3]: (error, inconclusive) Address of local auto-variable assigned to a function parameter. [autoVariables]\n", errout_str());

check("struct S { int *p; };\n"

"void g(struct S* s) {\n"

" int a[10];\n"

" s->p = a;\n"

" a[0] = 0;\n"

"}\n"

"void f() {\n"

" struct S s;\n"

" g(&s);\n"

"}\n");

ASSERT_EQUALS(

"[test.cpp:4:5]: (error) Address of local auto-variable assigned to a function parameter. [autoVariables]\n",

errout_str());

}

void testinvaliddealloc() {

check("void func1() {\n"

" char tmp1[256];\n"

" free(tmp1);\n"

" char tmp2[256];\n"

" delete tmp2;\n"

" char tmp3[256];\n"

" delete tmp3;\n"

" char tmp4[256];\n"

" delete[] (tmp4);\n"

" char tmp5[256];\n"

" delete[] tmp5;\n"

"}\n");

ASSERT_EQUALS("[test.cpp:3:10]: (error) Deallocation of an auto-variable results in undefined behaviour. [autovarInvalidDeallocation]\n"

"[test.cpp:5:12]: (error) Deallocation of an auto-variable results in undefined behaviour. [autovarInvalidDeallocation]\n"

"[test.cpp:7:12]: (error) Deallocation of an auto-variable results in undefined behaviour. [autovarInvalidDeallocation]\n"

"[test.cpp:9:15]: (error) Deallocation of an auto-variable results in undefined behaviour. [autovarInvalidDeallocation]\n"

"[test.cpp:11:14]: (error) Deallocation of an auto-variable results in undefined behaviour. [autovarInvalidDeallocation]\n", errout_str());

check("void func1(char * ptr) {\n"

" free(ptr);\n"

"}\n");

ASSERT_EQUALS("", errout_str());

check("void func1() {\n"

" char* tmp1[256];\n"

" init(tmp1);\n"

" delete tmp1[34];\n"

"}\n");

ASSERT_EQUALS("", errout_str());

check("void func1() {\n"

" static char tmp1[256];\n"

" char *p = tmp1;\n"

" free(p);\n"

"}\n");

ASSERT_EQUALS("[test.cpp:4:10]: (error) Deallocation of a static variable (tmp1) results in undefined behaviour. [autovarInvalidDeallocation]\n", errout_str());

check("char tmp1[256];\n"

"void func1() {\n"

" char *p; if (x) p = tmp1;\n"

" free(p);\n"

"}\n");

ASSERT_EQUALS("[test.cpp:4:10]: (error) Deallocation of a global variable (tmp1) results in undefined behaviour. [autovarInvalidDeallocation]\n", errout_str());

check("void f()\n"

"{\n"

" char psz_title[10];\n"

" {\n"

" char *psz_title = 0;\n"

" abc(0, psz_title);\n"

" free(psz_title);\n"

" }\n"

"}\n");

ASSERT_EQUALS("", errout_str());

// #2298 new check: passing stack-address to free()

check("int main() {\n"

" int *p = malloc(4);\n"

" free(&p);\n"

" return 0;\n"

"}\n");

ASSERT_EQUALS("[test.cpp:3:10]: (error) Deallocation of an auto-variable results in undefined behaviour. [autovarInvalidDeallocation]\n", errout_str());

check("int main() {\n"

" int i;\n"

" free(&i);\n"

" return 0;\n"

"}\n");

ASSERT_EQUALS("[test.cpp:3:10]: (error) Deallocation of an auto-variable results in undefined behaviour. [autovarInvalidDeallocation]\n", errout_str());

// #5732

check("int main() {\n"

" long (*pKoeff)[256] = new long[9][256];\n"

" delete[] pKoeff;\n"

"}\n");

ASSERT_EQUALS("", errout_str());

check("int main() {\n"

" long *pKoeff[256];\n"

" delete[] pKoeff;\n"

"}\n");

ASSERT_EQUALS("[test.cpp:3:13]: (error) Deallocation of an auto-variable results in undefined behaviour. [autovarInvalidDeallocation]\n", errout_str());

check("int main() {\n"

" long *pKoeff[256];\n"

" free (pKoeff);\n"

"}\n");

ASSERT_EQUALS("[test.cpp:3:10]: (error) Deallocation of an auto-variable results in undefined behaviour. [autovarInvalidDeallocation]\n", errout_str());

check("void foo() {\n"

" const intPtr& intref = Getter();\n"

" delete intref;\n"

"}\n");

ASSERT_EQUALS("", errout_str());

check("void test() {\n"

" MyObj& obj = *new MyObj;\n"

" delete &obj;\n"

"}\n");

ASSERT_EQUALS("", errout_str());

// #6506

check("struct F {\n"

" void free(void*) {}\n"

"};\n"

"void foo() {\n"

" char c1[1];\n"

" F().free(c1);\n"

" char *c2 = 0;\n"

" F().free(&c2);\n"

"}\n");

ASSERT_EQUALS("", errout_str());

check("class foo {\n"

" void free(void* );\n"

" void someMethod() {\n"

" char **dst_copy = NULL;\n"

" free(&dst_copy);\n"

" }\n"

"};\n");

ASSERT_EQUALS("", errout_str());

// #6551

check("bool foo( ) {\n"

" SwTxtFld * pTxtFld = GetFldTxtAttrAt();\n"

" delete static_cast<SwFmtFld*>(&pTxtFld->GetAttr());\n"

"}\n");

ASSERT_EQUALS("", errout_str());

// #8910

check("void f() {\n"

" char stack[512];\n"

" RGNDATA *data;\n"

" if (data_size > sizeof (stack)) data = malloc (data_size);\n"

" else data = (RGNDATA *)stack;\n"

" if ((char *)data != stack) free (data);\n"

"}\n");

ASSERT_EQUALS("", errout_str());

// #8923

check("void f(char **args1, char *args2[]) {\n"

" free((char **)args1);\n"

" free((char **)args2);\n"

"}\n");

ASSERT_EQUALS("", errout_str());

// #10097

check("struct Array {\n"

" ~Array() { delete m_Arr; }\n"

" std::array<long, 256>* m_Arr{};\n"

"};\n"

"Array arr;\n");

ASSERT_EQUALS("", errout_str());

// #8174

check("struct S {};\n"

"void f() {\n"

" S s;\n"

" S* p = &s;\n"

" free(p);\n"

"}\n");

ASSERT_EQUALS("[test.cpp:5:10]: (error) Deallocation of an auto-variable (s) results in undefined behaviour. [autovarInvalidDeallocation]\n", errout_str());

check("void f(bool b, int* q) {\n"

" int i;\n"

" int* p = b ? &i : q;\n"

" if (!b)\n"

" free(p);\n"

"}\n");

ASSERT_EQUALS("", errout_str());

check("struct E { int* i; };\n" // #11768

"struct C { E e; };\n"

"int foo(C* cin) {\n"

" E* e = &cin->e;\n"

" e->i = new int[42];\n"

" delete[] e->i;\n"

" return 0;\n"

"}\n");

ASSERT_EQUALS("", errout_str());

check("void f() {\n"

" S* p = &g();\n"

" delete p;\n"

"}\n");

ASSERT_EQUALS("", errout_str());

}

void testinvaliddealloc_input() {

// #10600

check("void f(int* a[]) {\n"

" free(a);\n"

"}\n");

ASSERT_EQUALS("", errout_str());

check("void f(int a[]) {\n"

" free(a);\n"

"}\n");

ASSERT_EQUALS("", errout_str());

check("void f(int* a[]) {\n"

" int * p = *a;\n"

" free(p);\n"

" int ** q = a;\n"

" free(q);\n"

"}\n");

ASSERT_EQUALS("", errout_str());

check("void f(int a[]) {\n"

" int * p = a;\n"

" free(p);\n"

"}\n");

ASSERT_EQUALS("", errout_str());

}

void testinvaliddealloc_string() {

// #7341

check("void f() {\n"

" char *ptr = \"a\";\n"

" free(\"a\");\n"

" delete \"a\";\n"

" free(ptr);\n"

" delete ptr;\n"

" char * p = malloc(1000);\n"

" p = \"abc\";\n"

" free(p);\n"

"}\n");

ASSERT_EQUALS("[test.cpp:3:10]: (error) Deallocation of a string literal results in undefined behaviour. [autovarInvalidDeallocation]\n"

"[test.cpp:4:12]: (error) Deallocation of a string literal results in undefined behaviour. [autovarInvalidDeallocation]\n"

"[test.cpp:5:10]: (error) Deallocation of a pointer pointing to a string literal (\"a\") results in undefined behaviour. [autovarInvalidDeallocation]\n"

"[test.cpp:6:12]: (error) Deallocation of a pointer pointing to a string literal (\"a\") results in undefined behaviour. [autovarInvalidDeallocation]\n"

"[test.cpp:9:10]: (error) Deallocation of a pointer pointing to a string literal (\"abc\") results in undefined behaviour. [autovarInvalidDeallocation]\n",

errout_str());

check("void f() {\n"

" char *ptr = malloc(10);\n"

" char *empty_str = \"\";\n"

" if (ptr == NULL)\n"

" ptr = empty_str;\n"

" if (ptr != empty_str)\n"

" free(ptr);\n"

"}\n");

ASSERT_EQUALS("", errout_str());

}

void testinvaliddealloc_C() {

// #5691

check("void svn_repos_dir_delta2() {\n"

" struct context c;\n"

" SVN_ERR(delete(&c, root_baton, src_entry, pool));\n"

"}\n", dinit(CheckOptions, $.inconclusive = false, $.cpp = false));

ASSERT_EQUALS("", errout_str());

}

void testassign1() { // Ticket #1819

check("void f(EventPtr *eventP, ActionPtr **actionsP) {\n"

" EventPtr event = *eventP;\n"

" *actionsP = &event->actions;\n"

"}\n");

ASSERT_EQUALS("", errout_str());

}

void testassign2() { // Ticket #2765

check("static void function(unsigned long **datap) {\n"

" struct my_s *mr = global_structure_pointer;\n"

" *datap = &mr->value;\n"

"}\n");

ASSERT_EQUALS("", errout_str());

}

void assignAddressOfLocalArrayToGlobalPointer() {