Skip to content

Commit 32d9610

Browse files
authored
Fix 6370: ValueFlow: array element with known value (#4447)
* Fix 6370: ValueFlow: array element with known value * Format * Move comment
1 parent 6543b42 commit 32d9610

2 files changed

Lines changed: 19 additions & 2 deletions

File tree

lib/valueflow.cpp

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1433,16 +1433,20 @@ static void valueFlowArrayElement(TokenList* tokenlist, const Settings* settings
14331433
for (const ValueFlow::Value& arrayValue : arrayTok->values()) {
14341434
if (!arrayValue.isTokValue())
14351435
continue;
1436+
if (arrayValue.isImpossible())
1437+
continue;
14361438
for (const ValueFlow::Value& indexValue : indexTok->values()) {
14371439
if (!indexValue.isIntValue())
14381440
continue;
1439-
if (arrayValue.varId != 0 && indexValue.varId != 0 &&
1441+
if (indexValue.isImpossible())
1442+
continue;
1443+
if (!arrayValue.isKnown() && !indexValue.isKnown() && arrayValue.varId != 0 && indexValue.varId != 0 &&
14401444
!(arrayValue.varId == indexValue.varId && arrayValue.varvalue == indexValue.varvalue))
14411445
continue;
14421446

14431447
ValueFlow::Value result(0);
14441448
result.condition = arrayValue.condition ? arrayValue.condition : indexValue.condition;
1445-
result.setInconclusive(arrayValue.isInconclusive() | indexValue.isInconclusive());
1449+
result.setInconclusive(arrayValue.isInconclusive() || indexValue.isInconclusive());
14461450
result.varId = (arrayValue.varId != 0) ? arrayValue.varId : indexValue.varId;
14471451
result.varvalue = (result.varId == arrayValue.varId) ? arrayValue.intvalue : indexValue.intvalue;
14481452
if (arrayValue.valueKind == indexValue.valueKind)

test/testbufferoverrun.cpp

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -194,6 +194,7 @@ class TestBufferOverrun : public TestFixture {
194194
TEST_CASE(array_index_66); // #10740
195195
TEST_CASE(array_index_67); // #1596
196196
TEST_CASE(array_index_68); // #6655
197+
TEST_CASE(array_index_69); // #6370
197198
TEST_CASE(array_index_multidim);
198199
TEST_CASE(array_index_switch_in_for);
199200
TEST_CASE(array_index_for_in_for); // FP: #2634
@@ -1889,6 +1890,18 @@ class TestBufferOverrun : public TestFixture {
18891890
ASSERT_EQUALS("[test.cpp:4]: (error) Array 'ia[10]' accessed at index 19, which is out of bounds.\n", errout.str());
18901891
}
18911892

1893+
// #6370
1894+
void array_index_69()
1895+
{
1896+
check("void f() {\n"
1897+
" const int e[] = {0,10,20,30};\n"
1898+
" int a[4];\n"
1899+
" for(int i = 0; i < 4; ++i)\n"
1900+
" a[e[i]] = 0;\n"
1901+
"}\n");
1902+
ASSERT_EQUALS("[test.cpp:5]: (error) Array 'a[4]' accessed at index 30, which is out of bounds.\n", errout.str());
1903+
}
1904+
18921905
void array_index_multidim() {
18931906
check("void f()\n"
18941907
"{\n"

0 commit comments

Comments
 (0)