fix #11542: FP memleak when using memcpy() with pointer (#6792)

Author: ludviggunne

lib/checkleakautovar.cpp

@@ -363,6 +363,40 @@ bool CheckLeakAutoVar::checkScope(const Token * const startToken,
         while (Token::Match(ftok, "%name% :: %name%"))
             ftok = ftok->tokAt(2);
 
+        // bailout for variable passed to library function with out parameter
+        if (const Library::Function *libFunc = mSettings->library.getFunction(ftok)) {
+            using ArgumentChecks = Library::ArgumentChecks;
+            using Direction = ArgumentChecks::Direction;
+            const std::vector<const Token *> args = getArguments(ftok);
+            const std::map<int, ArgumentChecks> &argChecks = libFunc->argumentChecks;
+            bool hasOutParam = std::any_of(argChecks.cbegin(), argChecks.cend(), [](const std::pair<int, ArgumentChecks> &pair) {
+                return std::any_of(pair.second.direction.cbegin(), pair.second.direction.cend(), [](const Direction dir) {
+                    return dir == Direction::DIR_OUT;
+                });
+            });
+            if (hasOutParam) {
+                for (int i = 0; i < args.size(); i++) {
+                    if (!argChecks.count(i + 1))
+                        continue;
+                    const ArgumentChecks argCheck = argChecks.at(i + 1);
+                    const bool isInParam = std::any_of(argCheck.direction.cbegin(), argCheck.direction.cend(), [&](const Direction dir) {
+                        return dir == Direction::DIR_IN;
+                    });
+                    if (!isInParam)
+                        continue;
+                    const Token *inTok = args[i];
+                    int indirect = 0;
+                    while (inTok->isUnaryOp("&")) {
+                        inTok = inTok->astOperand1();
+                        indirect++;
+                    }
+                    if (inTok->isVariable() && indirect) {
+                        varInfo.erase(inTok->varId());
+                    }
+                }
+            }
+        }
+
         auto isAssignment = [](const Token* varTok) -> const Token* {
             if (varTok->varId()) {
                 const Token* top = varTok;

test/testleakautovar.cpp

@@ -64,6 +64,9 @@ class TestLeakAutoVar : public TestFixture {
         TEST_CASE(assign25);
         TEST_CASE(assign26);
 
+        TEST_CASE(memcpy1); // #11542
+        TEST_CASE(memcpy2);
+
         TEST_CASE(isAutoDealloc);
 
         TEST_CASE(realloc1);
@@ -635,6 +638,24 @@ class TestLeakAutoVar : public TestFixture {
         ASSERT_EQUALS("", errout_str());
     }
 
+    void memcpy1() { // #11542
+        const Settings s = settingsBuilder().library("std.cfg").build();
+        check("void f(char** old, char* value) {\n"
+              "    char *str = strdup(value);\n"
+              "    memcpy(old, &str, sizeof(char*));\n"
+              "}\n", &s);
+        ASSERT_EQUALS("", errout_str());
+    }
+
+    void memcpy2() {
+        const Settings s = settingsBuilder().library("std.cfg").build();
+        check("void f(char* old, char* value, size_t len) {\n"
+              "    char *str = strdup(value);\n"
+              "    memcpy(old, str, len);\n"
+              "}\n", &s);
+        ASSERT_EQUALS("[test.cpp:4]: (error) Memory leak: str\n", errout_str());
+    }
+
     void isAutoDealloc() {
         check("void f() {\n"
               "    char *p = new char[100];"