Skip to content

Commit b8005e1

Browse files
Fix #12318 FP negativeIndex with do while loop (danmar#6720)
1 parent 6faed30 commit b8005e1

File tree

2 files changed

+13
-1
lines changed

2 files changed

+13
-1
lines changed

lib/forwardanalyzer.cpp

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -480,7 +480,7 @@ namespace {
480480
if (!checkThen && !checkElse && !isDoWhile && stopOnCondition(condTok) && stopUpdates())
481481
return Break(Analyzer::Terminate::Conditional);
482482
// condition is false, we don't enter the loop
483-
if (checkElse)
483+
if (checkElse && !isDoWhile)
484484
return Progress::Continue;
485485
if (checkThen || isDoWhile) {
486486
// Since we are re-entering the loop then assume the condition is true to update the state

test/testbufferoverrun.cpp

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2799,6 +2799,18 @@ class TestBufferOverrun : public TestFixture {
27992799
ASSERT_EQUALS("[test.cpp:3] -> [test.cpp:3]: (warning) Either the condition 's>sizeof(a)' is redundant or the array 'a[16]' is accessed at index 16, which is out of bounds.\n",
28002800
errout_str());
28012801

2802+
check("void f(int fd) {\n" // #12318
2803+
" char buf[10];\n"
2804+
" int size = 0;\n"
2805+
" int pos = -1;\n"
2806+
" do {\n"
2807+
" pos++;\n"
2808+
" size = read(fd, &buf[pos], 1);\n"
2809+
" } while (size > 0);\n"
2810+
" buf[pos] = '\\0';\n"
2811+
"}\n");
2812+
ASSERT_EQUALS("", errout_str());
2813+
28022814
}
28032815

28042816
void array_index_valueflow_pointer() {

0 commit comments

Comments
 (0)