Fix 10643: FP: (error) Array 'buf[64]' accessed at index -1, which is…

… out of bounds. (danmar#3639) * Fix 10643: FP: (error) Array 'buf[64]' accessed at index -1, which is out of bounds. * Format
captaingoodnight · Dec 17, 2021 · 4fb43a3 · 4fb43a3
1 parent 398fa28
commit 4fb43a3
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 1 deletion.
diff --git a/lib/valueflow.cpp b/lib/valueflow.cpp
@@ -5544,7 +5544,7 @@ struct ConditionHandler {
                 bool dead_if = deadBranch[0];
                 bool dead_else = deadBranch[1];
                 const Token* unknownFunction = nullptr;
-                if (tok->astParent() && Token::simpleMatch(tok->astParent()->previous(), "while ("))
+                if (tok->astParent() && Token::Match(top->previous(), "while|for ("))
                     dead_if = !isBreakScope(after);
                 else if (!dead_if)
                     dead_if = isReturnScope(after, &settings->library, &unknownFunction);

diff --git a/test/testbufferoverrun.cpp b/test/testbufferoverrun.cpp
@@ -187,6 +187,7 @@ class TestBufferOverrun : public TestFixture {
         TEST_CASE(array_index_negative1);
         TEST_CASE(array_index_negative2);    // ticket #3063
         TEST_CASE(array_index_negative3);
+        TEST_CASE(array_index_negative4);
         TEST_CASE(array_index_for_decr);
         TEST_CASE(array_index_varnames);     // FP: struct member. #1576
         TEST_CASE(array_index_for_continue); // for,continue
@@ -2031,6 +2032,17 @@ class TestBufferOverrun : public TestFixture {
         ASSERT_EQUALS("", errout.str());
     }
 
+    void array_index_negative4()
+    {
+        check("void f(void) {\n"
+              "    int buf[64]={};\n"
+              "    int i;\n"
+              "    for(i=0; i <16; ++i){}\n"
+              "    for(; i < 24; ++i){ buf[i] = buf[i-16];}\n"
+              "}\n");
+        ASSERT_EQUALS("", errout.str());
+    }
+
     void array_index_for_decr() {
         check("void f()\n"
               "{\n"