/*

* Cppcheck - A tool for static C/C++ code analysis

* Copyright (C) 2007-2026 Cppcheck team.

*

* This program is free software: you can redistribute it and/or modify

* it under the terms of the GNU General Public License as published by

* the Free Software Foundation, either version 3 of the License, or

* (at your option) any later version.

*

* This program is distributed in the hope that it will be useful,

* but WITHOUT ANY WARRANTY; without even the implied warranty of

* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

* GNU General Public License for more details.

*

* You should have received a copy of the GNU General Public License

* along with this program. If not, see <http://www.gnu.org/licenses/>.

*/

#include "check.h"

#include "checknullpointer.h"

#include "ctu.h"

#include "errortypes.h"

#include "fixture.h"

#include "helpers.h"

#include "library.h"

#include "settings.h"

#include "standards.h"

#include "token.h"

#include <cstddef>

#include <list>

#include <string>

class TestNullPointer : public TestFixture {

public:

TestNullPointer() : TestFixture("TestNullPointer") {}

private:

const Settings settings = settingsBuilder().library("std.cfg").severity(Severity::warning).build();

const Settings settings_i = settingsBuilder(settings).certainty(Certainty::inconclusive).build();

void run() override {

mNewTemplate = true;

TEST_CASE(nullpointerAfterLoop);

TEST_CASE(nullpointer1);

TEST_CASE(nullpointer2);

TEST_CASE(structDerefAndCheck); // dereferencing struct and then checking if it's null

TEST_CASE(pointerDerefAndCheck);

TEST_CASE(nullpointer5); // References should not be checked

TEST_CASE(nullpointerExecutionPaths);

TEST_CASE(nullpointerExecutionPathsLoop);

TEST_CASE(nullpointer7);

TEST_CASE(nullpointer9);

TEST_CASE(nullpointer10);

TEST_CASE(nullpointer11); // ticket #2812

TEST_CASE(nullpointer12); // ticket #2470

TEST_CASE(nullpointer15); // #3560 (fp: return p ? f(*p) : f(0))

TEST_CASE(nullpointer16); // #3591

TEST_CASE(nullpointer17); // #3567

TEST_CASE(nullpointer18); // #1927

TEST_CASE(nullpointer19); // #3811

TEST_CASE(nullpointer20); // #3807 (fp: return p ? (p->x() || p->y()) : z)

TEST_CASE(nullpointer21); // #4038 (fp: if (x) p=q; else return;)

TEST_CASE(nullpointer23); // #4665 (false positive)

TEST_CASE(nullpointer24); // #5082 fp: chained assignment

TEST_CASE(nullpointer25); // #5061

TEST_CASE(nullpointer26); // #3589

TEST_CASE(nullpointer27); // #6568

TEST_CASE(nullpointer28); // #6491

TEST_CASE(nullpointer30); // #6392

TEST_CASE(nullpointer31); // #8482

TEST_CASE(nullpointer32); // #8460

TEST_CASE(nullpointer33);

TEST_CASE(nullpointer34);

TEST_CASE(nullpointer35);

TEST_CASE(nullpointer36); // #9264

TEST_CASE(nullpointer37); // #9315

TEST_CASE(nullpointer38);

TEST_CASE(nullpointer39); // #2153

TEST_CASE(nullpointer40);

TEST_CASE(nullpointer41);

TEST_CASE(nullpointer42);

TEST_CASE(nullpointer43); // #9404

TEST_CASE(nullpointer44); // #9395, #9423

TEST_CASE(nullpointer45);

TEST_CASE(nullpointer46); // #9441

TEST_CASE(nullpointer47); // #6850

TEST_CASE(nullpointer48); // #9196

TEST_CASE(nullpointer49); // #7804

TEST_CASE(nullpointer50); // #6462

TEST_CASE(nullpointer51);

TEST_CASE(nullpointer52);

TEST_CASE(nullpointer53); // #8005

TEST_CASE(nullpointer54); // #9573

TEST_CASE(nullpointer55); // #8144

TEST_CASE(nullpointer56); // #9701

TEST_CASE(nullpointer57); // #9751

TEST_CASE(nullpointer58); // #9807

TEST_CASE(nullpointer59); // #9897

TEST_CASE(nullpointer60); // #9842

TEST_CASE(nullpointer61);

TEST_CASE(nullpointer62);

TEST_CASE(nullpointer63);

TEST_CASE(nullpointer64);

TEST_CASE(nullpointer65); // #9980

TEST_CASE(nullpointer66); // #10024

TEST_CASE(nullpointer67); // #10062

TEST_CASE(nullpointer68);

TEST_CASE(nullpointer69); // #8143

TEST_CASE(nullpointer70);

TEST_CASE(nullpointer71); // #10178

TEST_CASE(nullpointer72); // #10215

TEST_CASE(nullpointer73); // #10321

TEST_CASE(nullpointer74);

TEST_CASE(nullpointer75);

TEST_CASE(nullpointer76); // #10408

TEST_CASE(nullpointer77);

TEST_CASE(nullpointer78); // #7802

TEST_CASE(nullpointer79); // #10400

TEST_CASE(nullpointer80); // #10410

TEST_CASE(nullpointer81); // #8724

TEST_CASE(nullpointer82); // #10331

TEST_CASE(nullpointer83); // #9870

TEST_CASE(nullpointer84); // #9873

TEST_CASE(nullpointer85); // #10210

TEST_CASE(nullpointer86);

TEST_CASE(nullpointer87); // #9291

TEST_CASE(nullpointer88); // #9949

TEST_CASE(nullpointer89); // #10640

TEST_CASE(nullpointer90); // #6098

TEST_CASE(nullpointer91); // #10678

TEST_CASE(nullpointer92);

TEST_CASE(nullpointer93); // #3929

TEST_CASE(nullpointer94); // #11040

TEST_CASE(nullpointer95); // #11142

TEST_CASE(nullpointer96); // #11416

TEST_CASE(nullpointer97); // #11229

TEST_CASE(nullpointer98); // #11458

TEST_CASE(nullpointer99); // #10602

TEST_CASE(nullpointer100); // #11636

TEST_CASE(nullpointer101); // #11382

TEST_CASE(nullpointer102);

TEST_CASE(nullpointer103);

TEST_CASE(nullpointer104); // #13881

TEST_CASE(nullpointer105); // #13861

TEST_CASE(nullpointer106); // #13682

TEST_CASE(nullpointer107); // #13682 (FP/FN cases around guards that depend on the pointer indirectly)

TEST_CASE(nullpointer108);

TEST_CASE(nullpointer109);

TEST_CASE(nullpointer110); // #14937

TEST_CASE(nullpointer_addressOf); // address of

TEST_CASE(nullpointerSwitch); // #2626

TEST_CASE(nullpointer_cast); // #4692

TEST_CASE(nullpointer_castToVoid); // #3771

TEST_CASE(nullpointer_subfunction);

TEST_CASE(pointerCheckAndDeRef); // check if pointer is null and then dereference it

TEST_CASE(nullConstantDereference); // Dereference NULL constant

TEST_CASE(gcc_statement_expression); // Don't crash

TEST_CASE(snprintf_with_zero_size);

TEST_CASE(snprintf_with_non_zero_size);

TEST_CASE(printf_with_invalid_va_argument);

TEST_CASE(scanf_with_invalid_va_argument);

TEST_CASE(nullpointer_in_return);

TEST_CASE(nullpointer_in_typeid);

TEST_CASE(nullpointer_in_alignof); // #11401

TEST_CASE(nullpointer_in_for_loop);

TEST_CASE(nullpointerDeadCode); // #11311

TEST_CASE(nullpointerDelete);

TEST_CASE(nullpointerSubFunction);

TEST_CASE(nullpointerExit);

TEST_CASE(nullpointerStdString);

TEST_CASE(nullpointerStdStream);

TEST_CASE(nullpointerSmartPointer);

TEST_CASE(nullpointerOutOfMemory);

TEST_CASE(nullpointerOutOfResources);

TEST_CASE(functioncall);

TEST_CASE(functioncalllibrary); // use Library to parse function call

TEST_CASE(functioncallDefaultArguments);

TEST_CASE(nullpointer_internal_error); // #5080

TEST_CASE(ticket6505);

TEST_CASE(subtract);

TEST_CASE(addNull);

TEST_CASE(isPointerDeRefFunctionDecl);

TEST_CASE(ctuTest);

}

struct CheckOptions

{

bool inconclusive = false;

bool cpp = true;

};

#define check(...) check_(__FILE__, __LINE__, __VA_ARGS__)

template<size_t size>

void check_(const char* file, int line, const char (&code)[size], const CheckOptions& options = make_default_obj()) {

const Settings& settings1 = options.inconclusive ? settings_i : settings;

check_(file, line, code, settings1, options.cpp);

}

template<size_t size>

void check_(const char* file, int line, const char (&code)[size], const Settings& s, bool cpp = true) {

// Tokenize..

SimpleTokenizer tokenizer(s, *this, cpp);

ASSERT_LOC(tokenizer.tokenize(code), file, line);

CheckNullPointer check;

runChecks(check, tokenizer, *this);

}

#define checkP(...) checkP_(__FILE__, __LINE__, __VA_ARGS__)

template<size_t size>

void checkP_(const char* file, int line, const char (&code)[size]) {

SimpleTokenizer2 tokenizer(settings, *this, code, "test.cpp");

// Tokenizer..

ASSERT_LOC(tokenizer.simplifyTokens1(""), file, line);

CheckNullPointer check;

runChecks(check, tokenizer, *this);

}

void nullpointerAfterLoop() {

// extracttests.start: struct Token { const Token *next() const; std::string str() const; };

check("void foo(const Token *tok)\n"

"{\n"

" while (tok);\n"

" tok = tok->next();\n"

"}\n", dinit(CheckOptions, $.inconclusive = true));

ASSERT_EQUALS("[test.cpp:3:12] -> [test.cpp:4:11]: (warning) Either the condition 'tok' is redundant or there is possible null pointer dereference: tok. [nullPointerRedundantCheck]\n", errout_str());

// #2681

{

const char code[] = "void foo(const Token *tok)\n"

"{\n"

" while (tok && tok->str() == \"=\")\n"

" tok = tok->next();\n"

"\n"

" if (tok->str() != \";\")\n"

" ;\n"

"}\n";

check(code);

ASSERT_EQUALS("[test.cpp:3:12] -> [test.cpp:6:9]: (warning) Either the condition 'tok' is redundant or there is possible null pointer dereference: tok. [nullPointerRedundantCheck]\n", errout_str());

}

check("void foo()\n"

"{\n"

" for (const Token *tok = tokens; tok; tok = tok->next())\n"

" {\n"

" while (tok && tok->str() != \";\")\n"

" tok = tok->next();\n"

" }\n"

"}\n");

TODO_ASSERT_EQUALS("[test.cpp:5] -> [test.cpp:3]: (warning) Either the condition 'while' is redundant or there is possible null pointer dereference: tok.\n", "", errout_str());

check("void foo(Token &tok)\n"

"{\n"

" for (int i = 0; i < tok.size(); i++ )\n"

" {\n"

" while (!tok)\n"

" char c = tok.read();\n"

" }\n"

"}\n");

ASSERT_EQUALS("", errout_str());

check("void foo()\n"

"{\n"

" for (const Token *tok = tokens; tok; tok = tok->next())\n"

" {\n"

" while (tok && tok->str() != \";\")\n"

" tok = tok->next();\n"

" if( !tok ) break;\n"

" }\n"

"}\n");

ASSERT_EQUALS("", errout_str());

check("void foo()\n"

"{\n"

" for (const Token *tok = tokens; tok; tok = tok ? tok->next() : NULL)\n"

" {\n"

" while (tok && tok->str() != \";\")\n"

" tok = tok->next();\n"

" }\n"

"}\n");

ASSERT_EQUALS("", errout_str());

check("void foo(A*a)\n"

"{\n"

" switch (a->b()) {\n"

" case 1:\n"

" while( a ){\n"

" a = a->next;\n"

" }\n"

" break;\n"

" case 2:\n"

" a->b();\n"

" break;\n"

" }\n"

"}\n");

ASSERT_EQUALS("", errout_str());

// dereference in outer scope..

check("void foo(int x, const Token *tok) {\n"

" if (x == 123) {\n"

" while (tok) tok = tok->next();\n"

" }\n"

" tok->str();\n"

"}\n");

ASSERT_EQUALS("[test.cpp:3:16] -> [test.cpp:5:5]: (warning) Either the condition 'tok' is redundant or there is possible null pointer dereference: tok. [nullPointerRedundantCheck]\n", errout_str());

check("int foo(const Token *tok)\n"

"{\n"

" while (tok){;}\n"

"}\n", dinit(CheckOptions, $.inconclusive = true));

ASSERT_EQUALS("", errout_str());

check("int foo(const Token *tok)\n"

"{\n"

" while (tok){;}\n"

" char a[2] = {0,0};\n"

"}\n", dinit(CheckOptions, $.inconclusive = true));

ASSERT_EQUALS("", errout_str());

check("struct b {\n"

" b * c;\n"

" int i;\n"

"}\n"

"void a(b * e) {\n"

" for (b *d = e;d; d = d->c)\n"

" while (d && d->i == 0)\n"

" d = d->c;\n"

" if (!d) throw;\n"

"}\n");

ASSERT_EQUALS("", errout_str());

check("struct b {\n"

" b * c;\n"

" int i;\n"

"};\n"

"void f(b* e1, b* e2) {\n"

" for (const b* d = e1; d != e2; d = d->c) {\n"

" if (d && d->i != 0) {}\n"

" }\n"

"}\n");

ASSERT_EQUALS("[test.cpp:7:13] -> [test.cpp:6:40]: (warning) Either the condition 'd' is redundant or there is possible null pointer dereference: d. [nullPointerRedundantCheck]\n", errout_str());

}

void nullpointer1() {

// ticket #1923 - no false positive when using else if

check("void f(A *a)\n"

"{\n"

" if (a->x == 1)\n"

" {\n"

" a = a->next;\n"

" }\n"

" else if (a->x == 2) { }\n"

" if (a) { }\n"

"}\n");

ASSERT_EQUALS("", errout_str());

// ticket #2134 - sizeof doesn't dereference

check("void f() {\n"

" int c = 1;\n"

" int *list = NULL;\n"

" sizeof(*list);\n"

" if (!list)\n"

" ;\n"

"}\n", dinit(CheckOptions, $.inconclusive = true));

ASSERT_EQUALS("", errout_str());

// ticket #2245 - sizeof doesn't dereference

check("void f(Bar *p) {\n"

" if (!p) {\n"

" int sz = sizeof(p->x);\n"

" }\n"

"}\n", dinit(CheckOptions, $.inconclusive = true));

ASSERT_EQUALS("", errout_str());

}

void nullpointer2() {

// Null pointer dereference can only happen with pointers

check("void foo()\n"

"{\n"

" Fred fred;\n"

" while (fred);\n"

" fred.hello();\n"

"}\n", dinit(CheckOptions, $.inconclusive = true));

ASSERT_EQUALS("", errout_str());

}

// Dereferencing a struct and then checking if it is null

// This is checked by this function:

// CheckOther::nullPointerStructByDeRefAndCheck

void structDerefAndCheck() {

// extracttests.start: struct ABC { int a; int b; int x; };

// errors..

check("void foo(struct ABC *abc)\n"

"{\n"

" int a = abc->a;\n"

" if (!abc)\n"

" ;\n"

"}\n");

ASSERT_EQUALS("[test.cpp:4:9] -> [test.cpp:3:13]: (warning) Either the condition '!abc' is redundant or there is possible null pointer dereference: abc. [nullPointerRedundantCheck]\n", errout_str());

check("void foo(struct ABC *abc) {\n"

" bar(abc->a);\n"

" bar(x, abc->a);\n"

" bar(x, y, abc->a);\n"

" if (!abc)\n"

" ;\n"

"}\n");

ASSERT_EQUALS("[test.cpp:5:9] -> [test.cpp:2:9]: (warning) Either the condition '!abc' is redundant or there is possible null pointer dereference: abc. [nullPointerRedundantCheck]\n"

"[test.cpp:5:9] -> [test.cpp:3:12]: (warning) Either the condition '!abc' is redundant or there is possible null pointer dereference: abc. [nullPointerRedundantCheck]\n"

"[test.cpp:5:9] -> [test.cpp:4:15]: (warning) Either the condition '!abc' is redundant or there is possible null pointer dereference: abc. [nullPointerRedundantCheck]\n", errout_str());

check("void foo(ABC *abc) {\n"

" if (abc->a == 3) {\n"

" return;\n"

" }\n"

" if (abc) {}\n"

"}\n");

ASSERT_EQUALS(

"[test.cpp:5:9] -> [test.cpp:2:9]: (warning) Either the condition 'abc' is redundant or there is possible null pointer dereference: abc. [nullPointerRedundantCheck]\n",

errout_str());

check("void f(ABC *abc) {\n"

" if (abc->x == 0) {\n"

" return;\n"

" }\n"

" if (!abc);\n"

"}\n");

ASSERT_EQUALS("[test.cpp:5:9] -> [test.cpp:2:9]: (warning) Either the condition '!abc' is redundant or there is possible null pointer dereference: abc. [nullPointerRedundantCheck]\n", errout_str());

// TODO: False negative if member of member is dereferenced

check("void foo(ABC *abc) {\n"

" abc->next->a = 0;\n"

" if (abc->next)\n"

" ;\n"

"}\n");

TODO_ASSERT_EQUALS("[test.cpp:3] -> [test.cpp:2]: (warning) Possible null pointer dereference: abc - otherwise it is redundant to check it against null.\n", "", errout_str());

check("void foo(ABC *abc) {\n"

" abc->a = 0;\n"

" if (abc && abc->b == 0)\n"

" ;\n"

"}\n");

ASSERT_EQUALS(

"[test.cpp:3:9] -> [test.cpp:2:5]: (warning) Either the condition 'abc' is redundant or there is possible null pointer dereference: abc. [nullPointerRedundantCheck]\n",

errout_str());

// ok dereferencing in a condition

check("void foo(struct ABC *abc)\n"

"{\n"

" if (abc && abc->a);\n"

" if (!abc)\n"

" ;\n"

"}\n");

ASSERT_EQUALS("", errout_str());

check("void f(struct ABC *abc) {\n"

" int x = abc && a(abc->x);\n"

" if (abc) { }\n"

"}\n");

ASSERT_EQUALS("", errout_str());

// ok to use a linked list..

check("void foo(struct ABC *abc)\n"

"{\n"

" abc = abc->next;\n"

" if (!abc)\n"

" ;\n"

"}\n", dinit(CheckOptions, $.inconclusive = true));

ASSERT_EQUALS("", errout_str());

check("void f(struct ABC *abc) {\n"

" abc = (ABC *)(abc->_next);\n"

" if (abc) { }\n"

"}\n", dinit(CheckOptions, $.inconclusive = true));

ASSERT_EQUALS("", errout_str());

// reassign struct..

check("void foo(struct ABC *abc)\n"

"{\n"

" int a = abc->a;\n"

" abc = abc->next;\n"

" if (!abc)\n"

" ;\n"

"}\n", dinit(CheckOptions, $.inconclusive = true));

ASSERT_EQUALS("", errout_str());

check("void foo(struct ABC *abc)\n"

"{\n"

" int a = abc->a;\n"

" f(&abc);\n"

" if (!abc)\n"

" ;\n"

"}\n", dinit(CheckOptions, $.inconclusive = true));

ASSERT_EQUALS("", errout_str());

// goto..

check("void foo(struct ABC *abc)\n"

"{\n"

" int a;\n"

" if (!abc)\n"

" goto out;"

" a = abc->a;\n"

" return;\n"

"out:\n"

" if (!abc)\n"

" ;\n"

"}\n");

ASSERT_EQUALS("", errout_str());

// loops..

check("void foo(struct ABC *abc)\n"

"{\n"

" int a = abc->a;"

" do\n"

" {\n"

" if (abc)\n"

" abc = abc->next;\n"

" --a;\n"

" }\n"

" while (a > 0);\n"

"}\n");

ASSERT_EQUALS("", errout_str());

check("void f()\n"

"{\n"

" for (const Token *tok = _tokenizer->tokens(); tok; tok = tok->next())\n"

" {\n"

" while (tok && tok->str() != \"{\")\n"

" tok = tok->next();\n"

" if (!tok)\n"

" return;\n"

" }\n"

"}\n");

ASSERT_EQUALS("", errout_str());

// dynamic_cast..

check("void foo(ABC *abc)\n"

"{\n"

" int a = abc->a;\n"

" if (!dynamic_cast<DEF *>(abc))\n"

" ;\n"

"}\n");

ASSERT_EQUALS("", errout_str());

// #2641 - global pointer, function call

check("ABC *abc;\n"

"void f() {\n"

" abc->a = 0;\n"

" do_stuff();\n"

" if (abc) { }\n"

"}\n");

ASSERT_EQUALS("",errout_str());

check("Fred *fred;\n"

"void f() {\n"

" fred->foo();\n"

" if (fred) { }\n"

"}\n");

ASSERT_EQUALS("",errout_str());

// #2641 - local pointer, function call

check("void f() {\n"

" ABC *abc = abc1;\n"

" abc->a = 0;\n"

" do_stuff();\n"

" if (abc) { }\n"

"}\n");

ASSERT_EQUALS(

"[test.cpp:5:9] -> [test.cpp:3:5]: (warning) Either the condition 'abc' is redundant or there is possible null pointer dereference: abc. [nullPointerRedundantCheck]\n",

errout_str());

// #2641 - local pointer, function call

check("void f(ABC *abc) {\n"

" abc->a = 0;\n"

" do_stuff();\n"

" if (abc) { }\n"

"}\n");

ASSERT_EQUALS(

"[test.cpp:4:9] -> [test.cpp:2:5]: (warning) Either the condition 'abc' is redundant or there is possible null pointer dereference: abc. [nullPointerRedundantCheck]\n",

errout_str());

// #2691 - switch/break

check("void f(ABC *abc) {\n"

" switch ( x ) {\n"

" case 14:\n"

" sprintf(buf, \"%d\", abc->a);\n"

" break;\n"

" case 15:\n"

" if ( abc ) {}\n"

" break;\n"

" }\n"

"}\n");

ASSERT_EQUALS("", errout_str());

// #3128

check("void f(ABC *abc) {\n"

" x(!abc || y(abc->a));\n"

" if (abc) {}\n"

"}\n");

ASSERT_EQUALS("", errout_str());

check("void f(ABC *abc) {\n"

" x(def || !abc || y(def, abc->a));\n"

" if (abc) {}\n"

"}\n");

ASSERT_EQUALS("", errout_str());

check("void f(ABC *abc) {\n"

" x(abc && y(def, abc->a));\n"

" if (abc) {}\n"

"}\n");

ASSERT_EQUALS("", errout_str());

check("void f(ABC *abc) {\n"

" x(def && abc && y(def, abc->a));\n"

" if (abc) {}\n"

"}\n");

ASSERT_EQUALS("", errout_str());

// #3228 - calling function with null object

{

const char code[] = "void f(Fred *fred) {\n"

" fred->x();\n"

" if (fred) { }\n"

"}\n";

check(code);

ASSERT_EQUALS(

"[test.cpp:3:9] -> [test.cpp:2:5]: (warning) Either the condition 'fred' is redundant or there is possible null pointer dereference: fred. [nullPointerRedundantCheck]\n",

errout_str());

}

// #3425 - false positives when there are macros

checkP("#define IF if\n"

"void f(struct FRED *fred) {\n"

" fred->x = 0;\n"

" IF(!fred){}\n"

"}\n");

ASSERT_EQUALS("", errout_str());

check("void foo() {\n"

" BUFFER *buffer = get_buffer();\n"

" if (!buffer)\n"

" uv_fatal_error();\n"

" buffer->x = 11;\n"

"}\n");

ASSERT_EQUALS("", errout_str());

}

// Dereferencing a pointer and then checking if it is null

void pointerDerefAndCheck() {

// extracttests.start: void bar(int);

// errors..

check("void foo(int *p)\n"

"{\n"

" *p = 0;\n"

" if (!p)\n"

" ;\n"

"}\n");

ASSERT_EQUALS("[test.cpp:4:9] -> [test.cpp:3:6]: (warning) Either the condition '!p' is redundant or there is possible null pointer dereference: p. [nullPointerRedundantCheck]\n", errout_str());

check("void foo(int *p)\n"

"{\n"

" *p = 0;\n"

" if (p) { }\n"

"}\n");

ASSERT_EQUALS(

"[test.cpp:4:9] -> [test.cpp:3:6]: (warning) Either the condition 'p' is redundant or there is possible null pointer dereference: p. [nullPointerRedundantCheck]\n",

errout_str());

check("void foo(int *p)\n"

"{\n"

" *p = 0;\n"

" if (p || q) { }\n"

"}\n");

ASSERT_EQUALS(

"[test.cpp:4:9] -> [test.cpp:3:6]: (warning) Either the condition 'p' is redundant or there is possible null pointer dereference: p. [nullPointerRedundantCheck]\n",

errout_str());

check("void foo(int *p)\n"

"{\n"

" bar(*p);\n"

" if (!p)\n"

" ;\n"

"}\n");

ASSERT_EQUALS("[test.cpp:4:9] -> [test.cpp:3:10]: (warning) Either the condition '!p' is redundant or there is possible null pointer dereference: p. [nullPointerRedundantCheck]\n", errout_str());

check("void foo(char *p)\n"

"{\n"

" strcpy(p, \"abc\");\n"

" if (!p)\n"

" ;\n"

"}\n");

ASSERT_EQUALS("[test.cpp:4:9] -> [test.cpp:3:12]: (warning) Either the condition '!p' is redundant or there is possible null pointer dereference: p. [nullPointerRedundantCheck]\n", errout_str());

check("void foo(char *p)\n"

"{\n"

" if (*p == 0) { }\n"

" if (!p) { }\n"

"}\n");

ASSERT_EQUALS("[test.cpp:4:9] -> [test.cpp:3:10]: (warning) Either the condition '!p' is redundant or there is possible null pointer dereference: p. [nullPointerRedundantCheck]\n", errout_str());

// no error

check("void foo()\n"

"{\n"

" int *p;\n"

" f(&p);\n"

" if (!p)\n"

" ;\n"

"}\n");

ASSERT_EQUALS("", errout_str());

check("void foo()\n"

"{\n"

" int **p = f();\n"

" if (!p)\n"

" ;\n"

"}\n", dinit(CheckOptions, $.inconclusive = true));

ASSERT_EQUALS("", errout_str());

check("void foo(int *p)\n"

"{\n"

" if (x)\n"

" p = 0;\n"

" else\n"

" *p = 0;\n"

" if (!p)\n"

" ;\n"

"}\n");

ASSERT_EQUALS("", errout_str());

check("void foo(int x)\n"

"{\n"

" int a = 2 * x;"

" if (x == 0)\n"

" ;\n"

"}\n", dinit(CheckOptions, $.inconclusive = true));

ASSERT_EQUALS("", errout_str());

check("void foo(int *p)\n"

"{\n"

" int var1 = p ? *p : 0;\n"

" if (!p)\n"

" ;\n"

"}\n");

ASSERT_EQUALS("", errout_str());

check("void foo(int *p, bool x)\n"

"{\n"

" int var1 = x ? *p : 5;\n"

" if (!p)\n"

" ;\n"

"}\n");

ASSERT_EQUALS(

"[test.cpp:4:9] -> [test.cpp:3:21]: (warning) Either the condition '!p' is redundant or there is possible null pointer dereference: p. [nullPointerRedundantCheck]\n",

errout_str());

// while

check("void f(int *p) {\n"

" *p = 0;\n"

" while (p) { p = 0; }\n"

"}\n");

ASSERT_EQUALS("", errout_str());

check("void f(int *p) {\n"

" *p = 0;\n"

" while (p) { }\n"

"}\n");

ASSERT_EQUALS(

"[test.cpp:3:12] -> [test.cpp:2:6]: (warning) Either the condition 'p' is redundant or there is possible null pointer dereference: p. [nullPointerRedundantCheck]\n",

errout_str());

// Ticket #3125

check("void foo(ABC *p)\n"

"{\n"

" int var1 = p ? (p->a) : 0;\n"

" if (!p)\n"

" ;\n"

"}\n");

ASSERT_EQUALS("", errout_str());

check("void foo(ABC *p)\n"

"{\n"

" int var1 = p ? (1 + p->a) : 0;\n"

" if (!p)\n"

" ;\n"

"}\n");

ASSERT_EQUALS("", errout_str());

check("void f() {\n"

" int * a=0;\n"

" if (!a) {};\n"

" int c = a ? 0 : 1;\n"

"}\n",dinit(CheckOptions, $.inconclusive = true));

ASSERT_EQUALS("", errout_str());

// #3686

check("void f() {\n"

" int * a=0;\n"

" if (!a) {};\n"

" int c = a ? b : b+1;\n"

"}\n",dinit(CheckOptions, $.inconclusive = true));

ASSERT_EQUALS("", errout_str());

check("void f() {\n"

" int * a=0;\n"

" if (!a) {};\n"

" int c = (a) ? b : b+1;\n"

"}\n",dinit(CheckOptions, $.inconclusive = true));

ASSERT_EQUALS("", errout_str());

check("void foo(P *p)\n"

"{\n"

" while (p)\n"

" if (p->check())\n"

" break;\n"

" else\n"

" p = p->next();\n"

"}\n");

ASSERT_EQUALS("", errout_str());

check("void f(Document *doc) {\n"

" int x = doc && doc->x;\n"

" if (!doc) {\n"

" return;\n"

" }\n"

"}\n");

ASSERT_EQUALS("", errout_str());

// #3128 - false positive

check("void f(int *p) {\n"

" assert(!p || (*p<=6));\n"

" if (p) { *p = 0; }\n"

"}\n");

ASSERT_EQUALS("", errout_str());

check("void f(int *p) {\n"

" assert(p && (*p<=6));\n"

" if (p) { *p = 0; }\n"

"}\n");

ASSERT_EQUALS("", errout_str());

check("void f(int *p) {\n"

" *p = 12;\n"

" assert(p && (*p<=6));\n"

" if (p) { *p = 0; }\n"

"}\n");

ASSERT_EQUALS(

"[test.cpp:3:12] -> [test.cpp:2:6]: (warning) Either the condition 'p' is redundant or there is possible null pointer dereference: p. [nullPointerRedundantCheck]\n",

errout_str());

check("void foo(x *p)\n"

"{\n"

" p = p->next;\n"

" if (!p)\n"

" ;\n"

"}\n");

ASSERT_EQUALS("", errout_str());

check("void foo(x *p)\n"

"{\n"

" p = bar(p->next);\n"

" if (!p)\n"

" ;\n"

"}\n");

ASSERT_EQUALS("", errout_str());

check("void foo(x *p)\n"

"{\n"

" p = aa->bar(p->next);\n"

" if (!p)\n"

" ;\n"

"}\n");

ASSERT_EQUALS("", errout_str());

check("void foo(x *p)\n"

"{\n"

" p = *p2 = p->next;\n"

" if (!p)\n"

" ;\n"

"}\n");

ASSERT_EQUALS("", errout_str());

check("void foo(struct ABC *abc)\n"

"{\n"

" abc = abc ? abc->next : 0;\n"

" if (!abc)\n"

" ;\n"

"}\n");

ASSERT_EQUALS("", errout_str());

check("void f(struct ABC *abc) {\n" // #4523

" abc = (*abc).next;\n"

" if (abc) { }\n"

"}\n");

ASSERT_EQUALS("", errout_str());

check("void f(struct ABC *abc) {\n" // #4523

" abc = (*abc->ptr);\n"

" if (abc) { }\n"

"}\n");

ASSERT_EQUALS("", errout_str());

check("int f(Item *item) {\n"

" x = item ? ab(item->x) : 0;\n"

" if (item) { }\n"

"}\n");

ASSERT_EQUALS("", errout_str());

check("int f(Item *item) {\n"

" item->x = 0;\n"

" a = b ? c : d;\n"

" if (item) { }\n"

"}\n");

ASSERT_EQUALS(

"[test.cpp:4:9] -> [test.cpp:2:5]: (warning) Either the condition 'item' is redundant or there is possible null pointer dereference: item. [nullPointerRedundantCheck]\n",

errout_str());

check("BOOL GotoFlyAnchor()\n" // #2243

"{\n"

" const SwFrm* pFrm = GetCurrFrm();\n"

" do {\n"

" pFrm = pFrm->GetUpper();\n"

" } while( pFrm && !pFrm->IsFlyFrm() );\n"

"\n"

" if( !pFrm )\n"

" return FALSE;\n"

"}\n");

ASSERT_EQUALS("", errout_str());

// Ticket #2463

check("struct A\n"

"{\n"

" B* W;\n"

"\n"

" void f() {\n"

" switch (InData) {\n"

" case 2:\n"

" if (!W) return;\n"

" W->foo();\n"

" break;\n"

" case 3:\n"

" f();\n"

" if (!W) return;\n"

" break;\n"

" }\n"

" }\n"

"}\n");

ASSERT_EQUALS("", errout_str());

// #2525 - sizeof

check("void f() {\n"

" int *test = NULL;\n"

" int c = sizeof(test[0]);\n"

" if (!test)\n"

" ;\n"

"}\n", dinit(CheckOptions, $.inconclusive = true));

ASSERT_EQUALS("", errout_str());

check("void f(type* p) {\n" // #4983

" x(sizeof p[0]);\n"

" if (!p)\n"

" ;\n"

"}\n");

ASSERT_EQUALS("", errout_str());

// #3023 - checked deref

check("void f(struct ABC *abc) {\n"

" WARN_ON(!abc || abc->x == 0);\n"

" if (!abc) { }\n"

"}\n");

ASSERT_EQUALS("", errout_str());

check("void f(struct ABC *abc) {\n"

" WARN_ON(!abc || abc->x == 7);\n"

" if (!abc) { }\n"

"}\n");

ASSERT_EQUALS("", errout_str());

// #3425 - false positives when there are macros

checkP("#define IF if\n"

"void f(int *p) {\n"

" *p = 0;\n"

" IF(!p){}\n"

"}\n");

ASSERT_EQUALS("", errout_str());

check("void f() {\n" // #3914 - false positive

" int *p;\n"

" ((p=ret()) && (x=*p));\n"

" if (p);\n"

"}\n");