Skip to content

Fix #12091 (False negative: Uninitialized variable read in subfunction (regression)) #5739

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
danmar merged 3 commits into from
Dec 8, 2023
Merged

Fix #12091 (False negative: Uninitialized variable read in subfunction (regression)) #5739

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
5f40b98
Fix #12091 (False negative: Uninitialized variable read in subfunctio…
danmar Dec 5, 2023
52e86f2
fix ci
danmar Dec 8, 2023
97a0c50
clang-tidy
danmar Dec 8, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 10 additions & 3 deletions lib/valueflow.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7325,9 +7325,16 @@ struct MultiValueFlowAnalyzer : ValueFlowAnalyzer {
return false;
}

bool stopOnCondition(const Token* /*condTok*/) const override {
// TODO fix false negatives
return true; // isConditional();
bool stopOnCondition(const Token* condTok) const override {
if (isConditional())
return true;
if (!condTok->hasKnownIntValue() && values.count(condTok->varId()) == 0) {
const auto& values_ = condTok->values();
return std::any_of(values_.cbegin(), values_.cend(), [](const ValueFlow::Value& v) {
return v.isSymbolicValue() && Token::Match(v.tokvalue, "%oror%|&&");
});
}
return false;
}

bool updateScope(const Token* endBlock, bool /*modified*/) const override {
Expand Down
11 changes: 5 additions & 6 deletions test/teststl.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2403,12 +2403,11 @@ class TestStl : public TestFixture {
"void g(const std::vector<int>& w) {\n"
" f(-1, w);\n"
"}\n");
TODO_ASSERT_EQUALS("test.cpp:5:warning:Array index -1 is out of bounds.\n"
"test.cpp:8:note:Calling function 'f', 1st argument '-1' value is -1\n"
"test.cpp:3:note:Assuming condition is false\n"
"test.cpp:5:note:Negative array index\n",
"",
errout.str());
ASSERT_EQUALS("test.cpp:5:warning:Array index -1 is out of bounds.\n"
"test.cpp:8:note:Calling function 'f', 1st argument '-1' value is -1\n"
"test.cpp:3:note:Assuming condition is false\n"
"test.cpp:5:note:Negative array index\n",
errout.str());

settings = oldSettings;
}
Expand Down
2 changes: 1 addition & 1 deletion test/testuninitvar.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6559,7 +6559,7 @@ class TestUninitVar : public TestFixture {
" bool copied_all = true;\n"
" g(&copied_all, 5, 6, &bytesCopied);\n"
"}");
TODO_ASSERT_EQUALS("[test.cpp:7] -> [test.cpp:2]: (warning) Uninitialized variable: *buflen\n", "", errout.str());
ASSERT_EQUALS("[test.cpp:7] -> [test.cpp:2]: (warning) Uninitialized variable: *buflen\n", errout.str());

// # 9953
valueFlowUninit("uint32_t f(uint8_t *mem) {\n"
Expand Down
13 changes: 12 additions & 1 deletion test/testvalueflow.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4511,7 +4511,7 @@ class TestValueFlow : public TestFixture {
"void f(Object *obj) {\n"
" if (valid(obj, K0)) {}\n"
"}\n";
TODO_ASSERT_EQUALS(true, false, testValueOfX(code, 7U, 0));
ASSERT_EQUALS(true, testValueOfX(code, 7U, 0));
ASSERT_EQUALS(false, testValueOfXKnown(code, 7U, 0));

code = "int f(int i) {\n"
Expand Down Expand Up @@ -5624,6 +5624,17 @@ class TestValueFlow : public TestFixture {
"}\n";
values = tokenValues(code, "x <", ValueFlow::Value::ValueType::UNINIT);
ASSERT_EQUALS(0, values.size());

code = "void g(bool *result, size_t *buflen) {\n" // #12091
" if (*result && *buflen >= 5) {}\n" // <- *buflen might not be initialized
"}\n"
"void f() {\n"
" size_t bytesCopied;\n"
" bool copied_all = true;\n"
" g(&copied_all, &bytesCopied);\n"
"}";
values = tokenValues(code, "buflen >=", ValueFlow::Value::ValueType::UNINIT);
ASSERT_EQUALS(1, values.size());
}

void valueFlowConditionExpressions() {
Expand Down