Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix #12612 FP uninitvar with pointer alias in subfunction #7249

Open
wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Fix #12612 FP uninitvar with pointer alias in subfunction #7249

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
169b136
Fix #12612 FP uninitvar with pointer alias in subfunction
chrchr-github Jan 23, 2025
35393b0
Update vf_analyzers.cpp
chrchr-github Jan 23, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 7 additions & 2 deletions lib/vf_analyzers.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -586,7 +586,7 @@ struct ValueFlowAnalyzer : Analyzer {
} else if (ref->isUnaryOp("*") && !match(ref->astOperand1())) {
const Token* lifeTok = nullptr;
for (const ValueFlow::Value& v:ref->astOperand1()->values()) {
if (!v.isLocalLifetimeValue())
if (!v.isLocalLifetimeValue() && !v.isSubFunctionLifetimeValue())
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Instead of skipping subfunction lifetimes, you could just check that the path is the same if the propagated value's path(ie the value returned from getValue(lifetok)) is not zero.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Subfunction lifetimes were skipped before this change, and we didn't proceed to analyzeLifetime() below.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I see, I read it backwards. Its enabling it. We still need to check the correct path to avoid FPs.

continue;
if (lifeTok)
return Action::None;
Expand Down Expand Up @@ -1046,7 +1046,12 @@ struct MultiValueFlowAnalyzer : ValueFlowAnalyzer {
}

bool match(const Token* tok) const override {
return values.count(tok->varId()) > 0;
if (tok->varId() == 0)
return false;
return values.count(tok->varId()) > 0 ||
std::any_of(values.begin(), values.end(), [&](const std::pair<nonneg int, ValueFlow::Value>& p) {
return p.second.isUninitValue() && p.second.tokvalue->varId() == tok->varId();
});
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why is this extra check needed?

Copy link
Collaborator Author

@chrchr-github chrchr-github Jan 24, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Which check exactly? We now match in case there is an alias that has an uninit value pointing to the variable in question. But I'm not sure if it is correct to only check for uninit values.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That should happen in the analyzeToken function, not here. We are already checking for aliases there as well.

Finally the tokvalue is not always an alias either.

Copy link
Collaborator Author

@chrchr-github chrchr-github Jan 25, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

analyzeToken() has this:

Action la = analyzeLifetime(lifeTok);
if (la.matches()) { ...

So matches() needs to return true for the propagation of the uninit value to stop.
I looked at how that works for local code and tried to make the same stuff happen with a subfunction/valueFlowInjectParameter()

}

ProgramState getProgramState() const override {
Expand Down
11 changes: 11 additions & 0 deletions test/testuninitvar.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4387,6 +4387,17 @@ class TestUninitVar : public TestFixture {
" return f(i, 0);\n"
"}");
ASSERT_EQUALS("[test.cpp:8] -> [test.cpp:4]: (warning) Uninitialized variable: i\n", errout_str());

valueFlowUninit("char *f (char *b) {\n" // #12612
" char* p = b;\n"
" *p = '\\0';\n"
" return b;\n"
"}\n"
"void g() {\n"
" char a[24];\n"
" f(a);\n"
"}\n");
ASSERT_EQUALS("", errout_str());
}

void uninitStructMember() { // struct members
Expand Down
Loading