fixup! fixup! fixup! fixup! fixup! fixup! fixup! Fix #11311 Do not search for null pointer in dead code

Author: francois-berder

lib/checknullpointer.cpp

@@ -281,6 +281,9 @@ static bool isNullablePointer(const Token* tok)
 
 void CheckNullPointer::nullPointerByDeRefAndCheckToken(const Token *tok, const bool printInconclusive)
 {
+    if (!tok)
+        return;
+
     if (Token::Match(tok, "%num%|%char%|%str%"))
         return;
 
@@ -311,13 +314,26 @@ const Token * CheckNullPointer::nullPointerByDeRefAndCheck(const Token *start, c
 {
     for (const Token* tok = start; tok != end; tok = tok->next()) {
         if (Token::simpleMatch(tok, "while (")) {
+            if (!tok->next() || !tok->next()->link() || !tok->next()->astOperand2()) {
+                /* Garbage code */
+                return end;
+            }
+
             /* Analyze tokens inside condition */
             const Token *condTok = tok->next()->astOperand2();
             const Token *startCondTok = tok->next();
             const Token *endCondTok = tok->next()->link();
+            if (!Token::simpleMatch(startCondTok, "(") || !Token::simpleMatch(endCondTok, ")")) {
+                /* Garbage code */
+                return end;
+            }
             tok = nullPointerByDeRefAndCheck(startCondTok, endCondTok, printInconclusive);
 
             if (condTok->hasKnownIntValue() && condTok->getKnownIntValue() == 0) {
+                if (!tok->next()) {
+                    /* Garbage code */
+                    return end;
+                }
                 /* Skip body */
                 if (tok->next()->link())
                     tok = tok->next()->link();
@@ -326,33 +342,74 @@ const Token * CheckNullPointer::nullPointerByDeRefAndCheck(const Token *start, c
             bool prevBranchTaken = false;
             do {
                 if (prevBranchTaken) {
+                    if (!tok->next()) {
+                        /* Garbage code */
+                        return end;
+                    }
                     tok = tok->next()->linkAt(3); /* Skip condition */
+                    if (!tok || !tok->next() || !tok->next()->link()) {
+                        /* Garbage code */
+                        return end;
+                    }
                     tok = tok->next()->link(); /* Skip body */
                     continue;
                 }
 
+                if (!tok->next() || !tok->next()->next()) {
+                    /* Garbage code */
+                    return end;
+                }
+
                 /* Analyze condition */
                 const Token *ifTok = Token::simpleMatch(tok, "if (") ? tok : tok->next()->next()->next();
-                const Token *elseIfCondTok = ifTok->next()->astOperand2();
-                const Token *elseIfCondStartTok = ifTok->next();
-                const Token *elseIfCondEndTok = ifTok->next()->link();
-                tok = nullPointerByDeRefAndCheck(elseIfCondStartTok, elseIfCondEndTok, printInconclusive);
+                if (!ifTok || !ifTok->next() || !ifTok->next()->link() || !ifTok->next()->astOperand2()) {
+                    /* Garbage code */
+                    return end;
+                }
+                const Token *condTok = ifTok->next()->astOperand2();
+                const Token *condStartTok = ifTok->next();
+                const Token *condEndTok = ifTok->next()->link();
+                if (!Token::simpleMatch(condStartTok, "(") || !Token::simpleMatch(condEndTok, ")")) {
+                    /* Garbage code */
+                    return end;
+                }
+                tok = nullPointerByDeRefAndCheck(condStartTok, condEndTok, printInconclusive);
+                if (!tok || !tok->next() || !tok->next()->link()) {
+                    /* Garbage code */
+                    return end;
+                }
 
-                prevBranchTaken = prevBranchTaken || (elseIfCondTok->hasKnownIntValue() && elseIfCondTok->getKnownIntValue());
-                if (elseIfCondTok->hasKnownIntValue() && elseIfCondTok->getKnownIntValue() == 0) {
+                prevBranchTaken = prevBranchTaken || (condTok->hasKnownIntValue() && condTok->getKnownIntValue());
+                if (condTok->hasKnownIntValue() && condTok->getKnownIntValue() == 0) {
+                    if (!tok->next()->link()) {
+                        /* Garbage code */
+                        return end;
+                    }
                     /* Skip body */
                     tok = tok->next()->link();
                 } else {
                     /* Analyze body */
                     const Token *elseIfBodyStartTok = tok->next();
                     const Token *elseIfBodyEndTok = elseIfBodyStartTok->link();
+                    if (!Token::simpleMatch(elseIfBodyStartTok, "{") || !Token::simpleMatch(elseIfBodyEndTok, "}")) {
+                        /* Garbage code */
+                        return end;
+                    }
                     tok = nullPointerByDeRefAndCheck(elseIfBodyStartTok, elseIfBodyEndTok, printInconclusive);
                 }
+                if (!tok || !tok->next()) {
+                    /* Garbage code */
+                    return end;
+                }
             } while (Token::simpleMatch(tok->next(), "else { if (") && Token::simpleMatch(tok->next()->linkAt(3), ") {"));
 
             /* Handle final else branch */
             if (prevBranchTaken && Token::simpleMatch(tok->next(), "else")) {
                 /* Skip body */
+                if (!tok->next() || !tok->next()->next() || !tok->next()->next()->link()) {
+                    /* Garbage code */
+                    return end;
+                }
                 tok = tok->next()->next()->link();
             }
         } else if (Token::simpleMatch(tok, "?") && Token::simpleMatch(tok->astOperand2(), ":")) {  // ternary operator
@@ -364,11 +421,15 @@ const Token * CheckNullPointer::nullPointerByDeRefAndCheck(const Token *start, c
             }
         } else {
             if (isUnevaluated(tok)) {
+                if (!tok->next() || !tok->next()->link()) {
+                    /* Garbage code */
+                    return end;
+                }
+
                 tok = tok->next()->link();
-                continue;
+            } else {
+                nullPointerByDeRefAndCheckToken(tok, printInconclusive);
             }
-
-            nullPointerByDeRefAndCheckToken(tok, printInconclusive);
         }
     }