Skip to content

Fix 12033: false negative: uninitialized data passed as const data to function #5747

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
chrchr-github merged 4 commits into from
Dec 23, 2023
Merged

Fix 12033: false negative: uninitialized data passed as const data to function #5747

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
ddb7e00
Warn when passing by const pointer
pfultz2 Dec 10, 2023
a6f7fb5
Fix FP
pfultz2 Dec 10, 2023
e916105
Add test
pfultz2 Dec 10, 2023
6a9959f
Format
pfultz2 Dec 10, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 8 additions & 1 deletion lib/astutils.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2646,8 +2646,11 @@ bool isVariableChanged(const Token *tok, int indirect, const Settings *settings,
const Token * ptok = tok2;
while (Token::Match(ptok->astParent(), ".|::|["))
ptok = ptok->astParent();
int pindirect = indirect;
if (indirect == 0 && astIsLHS(tok2) && Token::Match(ptok, ". %var%") && astIsPointer(ptok->next()))
pindirect = 1;
bool inconclusive = false;
bool isChanged = isVariableChangedByFunctionCall(ptok, indirect, settings, &inconclusive);
bool isChanged = isVariableChangedByFunctionCall(ptok, pindirect, settings, &inconclusive);
isChanged |= inconclusive;
if (isChanged)
return true;
Expand Down Expand Up @@ -3250,6 +3253,8 @@ static ExprUsage getFunctionUsage(const Token* tok, int indirect, const Settings
continue;
if (arg->isReference())
return ExprUsage::PassedByReference;
if (arg->isPointer() && indirect == 1)
return ExprUsage::PassedByReference;
}
if (!args.empty() && indirect == 0 && !addressOf)
return ExprUsage::Used;
Expand Down Expand Up @@ -3294,6 +3299,8 @@ ExprUsage getExprUsage(const Token* tok, int indirect, const Settings* settings,
parent = parent->astParent();
if (Token::Match(parent, "%assign%") && (astIsRHS(tok) || astIsLHS(parent->astOperand1())))
return ExprUsage::NotUsed;
if (Token::Match(parent, "++|--"))
return ExprUsage::NotUsed;
if (parent->isConstOp())
return ExprUsage::NotUsed;
if (parent->isCast())
Expand Down
5 changes: 0 additions & 5 deletions lib/checkuninitvar.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1642,12 +1642,7 @@ void CheckUninitVar::valueFlowUninit()
const bool isarray = tok->variable()->isArray();
if (isarray && tok->variable()->isMember())
continue; // Todo: this is a bailout
const bool ispointer = astIsPointer(tok) && !isarray;
const bool deref = CheckNullPointer::isPointerDeRef(tok, unknown, mSettings);
if (ispointer && v->indirect == 1 && !deref)
continue;
if (isarray && !deref)
continue;
uninitderef = deref && v->indirect == 0;
const bool isleaf = isLeafDot(tok) || uninitderef;
if (!isleaf && Token::Match(tok->astParent(), ". %name%") && (tok->astParent()->next()->varId() || tok->astParent()->next()->isEnumerator()))
Expand Down
14 changes: 11 additions & 3 deletions test/testuninitvar.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6313,7 +6313,7 @@ class TestUninitVar : public TestFixture {
" f(a, b);\n"
" printf(\"%s\", a);\n"
"}");
ASSERT_EQUALS("[test.cpp:5]: (error) Uninitialized variable: a\n", errout.str());
ASSERT_EQUALS("[test.cpp:4]: (error) Uninitialized variable: a\n", errout.str());

valueFlowUninit("void usage(const char *);\n" // #10330
"int main(int argc, char* argv[]) {\n"
Expand All @@ -6334,6 +6334,14 @@ class TestUninitVar : public TestFixture {
" if (pwd == NULL) {}\n"
"}");
ASSERT_EQUALS("[test.cpp:15] -> [test.cpp:17]: (warning) Uninitialized variable: pwd\n", errout.str());

// #12033
valueFlowUninit("void g(const char*p);\n"
"void f() {\n"
" char buf[10];\n"
" g(buf);\n"
"}\n");
ASSERT_EQUALS("[test.cpp:4]: (error) Uninitialized variable: buf\n", errout.str());
}

void valueFlowUninitBreak() { // Do not show duplicate warnings about the same uninitialized value
Expand Down Expand Up @@ -6385,7 +6393,7 @@ class TestUninitVar : public TestFixture {
" someType_t gVar;\n"
" bar(&gVar);\n"
"}");
ASSERT_EQUALS("[test.cpp:9] -> [test.cpp:5]: (warning) Uninitialized variable: p->flags\n", errout.str());
ASSERT_EQUALS("[test.cpp:9]: (error) Uninitialized variable: &gVar\n", errout.str());

valueFlowUninit("typedef struct\n"
"{\n"
Expand Down Expand Up @@ -6917,7 +6925,7 @@ class TestUninitVar : public TestFixture {
" foo(123, &abc);\n"
" return abc.b;\n"
"}");
ASSERT_EQUALS("[test.cpp:6]: (error) Uninitialized variable: abc.b\n", errout.str());
ASSERT_EQUALS("[test.cpp:5]: (error) Uninitialized variable: &abc\n", errout.str());

valueFlowUninit("struct ABC { int a; int b; int c; };\n"
"void foo() {\n"
Expand Down