Fix #7570 support address-of operator on variables in getBufferSize()

Author: flovent

lib/checkbufferoverrun.cpp

@@ -553,6 +553,8 @@ ValueFlow::Value CheckBufferOverrun::getBufferSize(const Token *bufTok) const
 {
     if (!bufTok->valueType())
         return ValueFlow::Value(-1);
+    if (bufTok->isUnaryOp("&"))
+        bufTok = bufTok->astOperand1();
     const Variable *var = bufTok->variable();
 
     if (!var || var->dimensions().empty()) {
@@ -653,7 +655,7 @@ void CheckBufferOverrun::bufferOverflow()
                     argtok = argtok->astOperand2() ? argtok->astOperand2() : argtok->astOperand1();
                 while (Token::Match(argtok, ".|::"))
                     argtok = argtok->astOperand2();
-                if (!argtok || !argtok->variable())
+                if (!argtok)
                     continue;
                 if (argtok->valueType() && argtok->valueType()->pointer == 0)
                     continue;

test/testbufferoverrun.cpp

@@ -306,6 +306,8 @@ class TestBufferOverrun : public TestFixture {
         TEST_CASE(objectIndex);
 
         TEST_CASE(checkPipeParameterSize); // ticket #3521
+
+        TEST_CASE(getBufferSizeOfAddressOfVariable); // ticket #7570
     }
 
 
@@ -4320,7 +4322,7 @@ class TestBufferOverrun : public TestFixture {
               "  char c;\n"
               "  mymemset(&c, 0, 4);\n"
               "}", dinit(CheckOptions, $.s = &settings));
-        TODO_ASSERT_EQUALS("[test.cpp:3:14]: (error) Buffer is accessed out of bounds: c [bufferAccessOutOfBounds]\n", "", errout_str());
+        ASSERT_EQUALS("[test.cpp:3:12]: (error) Buffer is accessed out of bounds: &c [bufferAccessOutOfBounds]\n", errout_str());
 
         // ticket #2121 - buffer access out of bounds when using uint32_t
         check("void f(void) {\n"
@@ -5712,6 +5714,33 @@ class TestBufferOverrun : public TestFixture {
               "}", dinit(CheckOptions, $.s = &settings));
         ASSERT_EQUALS("", errout_str());
     }
+
+    void getBufferSizeOfAddressOfVariable() { // #7570
+
+      check("void f() {\n"
+            "  int i;\n"
+            "  memset(&i, 0, 1000);\n"
+            "}");
+      ASSERT_EQUALS("[test.cpp:3:10]: (error) Buffer is accessed out of bounds: &i [bufferAccessOutOfBounds]\n", errout_str());
+
+      check("void f() {\n"
+            "  int i;\n"
+            "  memset(&i, 0, sizeof(i));\n"
+            "}");
+      ASSERT_EQUALS("", errout_str());
+
+      check("void foo() {\n"
+            "  char c[6];\n"
+            "  strncpy(&c, \"hello!\", 6);\n"
+            "}");
+      ASSERT_EQUALS("[test.cpp:3:3]: (warning, inconclusive) The buffer '&c' may not be null-terminated after the call to strncpy(). [terminateStrncpy]\n", errout_str());
+
+      check("void foo() {\n"
+            "  char c[6];\n"
+            "  memcpy(&c, \"hello\\n\", 6);\n"
+            "}");
+      ASSERT_EQUALS("", errout_str());
+    }
 };
 
 REGISTER_TEST(TestBufferOverrun)