{

if (Token::Match(&tok, "%name% ( )") || !tok.tokAt(2))

return;

const Token* firstParam = tok.tokAt(2);

const Token* secondParam = firstParam->nextArgument();

// 1st parameter..

if (Token::Match(firstParam, "%var% ,|)") ||

(value == 0 && Token::Match(firstParam, "0|NULL ,|)"))) {

if (value == 0 && Token::Match(&tok, "snprintf|vsnprintf|fnprintf|vfnprintf") && secondParam && secondParam->str() != "0") // Only if length (second parameter) is not zero

var.push_back(firstParam);

}

// Library

if (library) {

const Token *param = firstParam;

int argnr = 1;

while (param) {

if (Token::Match(param, "%var% ,|)") || (value==0 && Token::Match(param, "0|NULL ,|)"))) {

if (value == 0 && library->isnullargbad(&tok, argnr) && checkNullpointerFunctionCallPlausibility(tok.function(), argnr))

var.push_back(param);

else if (value == 1 && library->isuninitargbad(&tok, argnr))

var.push_back(param);

}

param = param->nextArgument();

argnr++;

}

}

if (Token::Match(&tok, "printf|sprintf|snprintf|fprintf|fnprintf|scanf|sscanf|fscanf|wprintf|swprintf|fwprintf|wscanf|swscanf|fwscanf")) {

const Token* argListTok = 0; // Points to first va_list argument

std::string formatString;

bool scan = Token::Match(&tok, "scanf|sscanf|fscanf|wscanf|swscanf|fwscanf");

if (Token::Match(&tok, "printf|scanf|wprintf|wscanf ( %str%")) {

formatString = firstParam->strValue();

argListTok = secondParam;

} else if (Token::Match(&tok, "sprintf|fprintf|sscanf|fscanf|fwprintf|fwscanf|swscanf")) {

const Token* formatStringTok = secondParam; // Find second parameter (format string)

if (formatStringTok && formatStringTok->tokType() == Token::eString) {

argListTok = formatStringTok->nextArgument(); // Find third parameter (first argument of va_args)

formatString = formatStringTok->strValue();

}

} else if (Token::Match(&tok, "snprintf|fnprintf|swprintf") && secondParam) {

const Token* formatStringTok = secondParam->nextArgument(); // Find third parameter (format string)

if (formatStringTok && formatStringTok->tokType() == Token::eString) {

argListTok = formatStringTok->nextArgument(); // Find fourth parameter (first argument of va_args)

formatString = formatStringTok->strValue();

}

}

if (argListTok) {

bool percent = false;

for (std::string::iterator i = formatString.begin(); i != formatString.end(); ++i) {

if (*i == '%') {

percent = !percent;

} else if (percent) {

percent = false;

bool _continue = false;

while (!std::isalpha((unsigned char)*i)) {

if (*i == '*') {

if (scan)

_continue = true;

else

argListTok = argListTok->nextArgument();

}

++i;

if (!argListTok || i == formatString.end())

return;

}

if (_continue)

continue;

if ((*i == 'n' || *i == 's' || scan) && (!scan || value == 0)) {

if ((value == 0 && argListTok->str() == "0") || Token::Match(argListTok, "%var% [,)]")) {

var.push_back(argListTok);

}

}

if (*i != 'm') // %m is a non-standard glibc extension that requires no parameter

argListTok = argListTok->nextArgument(); // Find next argument

if (!argListTok)

break;

}

}

}

}

{

unknown = false;

const Token* parent = tok->astParent();

if (!parent)

return false;

if (parent->str() == "." && parent->astOperand2() == tok)

return isPointerDeRef(parent, unknown);

const bool firstOperand = parent->astOperand1() == tok;

while (parent->str() == "(" && (parent->astOperand2() == nullptr && parent->strAt(1) != ")")) { // Skip over casts

parent = parent->astParent();

if (!parent)

return false;

}

// Dereferencing pointer..

if (parent->str() == "*" && !parent->astOperand2() && !Token::Match(parent->tokAt(-2), "sizeof|decltype|typeof"))

return true;

// array access

if (firstOperand && parent->str() == "[" && (!parent->astParent() || parent->astParent()->str() != "&"))

return true;

// address of member variable / array element

const Token *parent2 = parent;

while (Token::Match(parent2, "[|."))

parent2 = parent2->astParent();

if (parent2 != parent && parent2 && parent2->str() == "&" && !parent2->astOperand2())

return false;

// read/write member variable

if (firstOperand && parent->str() == "." && (!parent->astParent() || parent->astParent()->str() != "&")) {

if (!parent->astParent() || parent->astParent()->str() != "(" || parent->astParent() == tok->previous())

return true;

unknown = true;

return false;

}

if (Token::Match(tok, "%name% ("))

return true;

if (Token::Match(tok, "%var% = %var% .") &&

tok->varId() == tok->tokAt(2)->varId())

return true;

// std::string dereferences nullpointers

if (Token::Match(parent->tokAt(-3), "std :: string|wstring (") && tok->strAt(1) == ")")

return true;

if (Token::Match(parent->previous(), "%name% (") && tok->strAt(1) == ")") {

const Variable* var = tok->tokAt(-2)->variable();

if (var && !var->isPointer() && !var->isArray() && var->isStlStringType())

return true;

}

// streams dereference nullpointers

if (Token::Match(parent, "<<|>>") && !firstOperand) {

const Variable* var = tok->variable();

if (var && var->isPointer() && Token::Match(var->typeStartToken(), "char|wchar_t")) { // Only outputting or reading to char* can cause problems

const Token* tok2 = parent; // Find start of statement

for (; tok2; tok2 = tok2->previous()) {

if (Token::Match(tok2->previous(), ";|{|}|:"))

break;

}

if (Token::Match(tok2, "std :: cout|cin|cerr"))

return true;

if (tok2 && tok2->varId() != 0) {

const Variable* var2 = tok2->variable();

if (var2 && var2->isStlType(stl_stream))

return true;

}

}

}

const Variable *ovar = nullptr;

if (Token::Match(parent, "+|==|!=") || (parent->str() == "=" && !firstOperand)) {

if (parent->astOperand1() == tok && parent->astOperand2())

ovar = parent->astOperand2()->variable();

else if (parent->astOperand1() && parent->astOperand2() == tok)

ovar = parent->astOperand1()->variable();

}

if (ovar && !ovar->isPointer() && !ovar->isArray() && ovar->isStlStringType())

return true;

// assume that it's not a dereference (no false positives)

return false;

{

if (!_settings->isEnabled("warning"))

return;

const SymbolDatabase* const symbolDatabase = _tokenizer->getSymbolDatabase();

// looping through items in a linked list in a inner loop.

// Here is an example:

// for (const Token *tok = tokens; tok; tok = tok->next) {

// if (tok->str() == "hello")

// tok = tok->next; // <- tok might become a null pointer!

// }

for (std::list<Scope>::const_iterator i = symbolDatabase->scopeList.begin(); i != symbolDatabase->scopeList.end(); ++i) {

const Token* const tok1 = i->classDef;

// search for a "for" scope..

if (i->type != Scope::eFor || !tok1)

continue;

// is there any dereferencing occurring in the for statement

const Token* end2 = tok1->linkAt(1);

for (const Token *tok2 = tok1->tokAt(2); tok2 != end2; tok2 = tok2->next()) {

// Dereferencing a variable inside the "for" parentheses..

if (Token::Match(tok2, "%var% . %name%")) {

// Is this variable a pointer?

const Variable *var = tok2->variable();

if (!var || !var->isPointer())

continue;

// Variable id for dereferenced variable

const unsigned int varid(tok2->varId());

if (Token::Match(tok2->tokAt(-2), "%varid% ?", varid))

continue;

// Check usage of dereferenced variable in the loop..

for (std::list<Scope*>::const_iterator j = i->nestedList.begin(); j != i->nestedList.end(); ++j) {

const Scope* const scope = *j;

if (scope->type != Scope::eWhile)

continue;

// TODO: are there false negatives for "while ( %varid% ||"

if (Token::Match(scope->classDef->next(), "( %varid% &&|)", varid)) {

// Make sure there is a "break" or "return" inside the loop.

// Without the "break" a null pointer could be dereferenced in the

// for statement.

for (const Token *tok4 = scope->classStart; tok4; tok4 = tok4->next()) {

if (tok4 == i->classEnd) {

nullPointerError(tok1, var->name(), scope->classDef, false);

break;

}

// There is a "break" or "return" inside the loop.

// TODO: there can be false negatives. There could still be

// execution paths that are not properly terminated

else if (tok4->str() == "break" || tok4->str() == "return")

break;

}

}

}

}

}

}

{

const bool printWarnings = _settings->isEnabled("warning");

const bool printInconclusive = (_settings->inconclusive);

for (const Token *tok = _tokenizer->tokens(); tok; tok = tok->next()) {

if (Token::Match(tok, "sizeof|decltype|typeid|typeof (")) {

tok = tok->next()->link();

continue;

}

const Variable *var = tok->variable();

if (!var || !var->isPointer() || tok == var->nameToken())

continue;

// Can pointer be NULL?

const ValueFlow::Value *value = tok->getValue(0);

if (!value)

continue;

if (!printInconclusive && value->inconclusive)

continue;

// Is pointer used as function parameter?

if (Token::Match(tok->previous(), "[(,] %name% [,)]")) {

const Token *ftok = tok->previous();

while (ftok && ftok->str() != "(") {

if (ftok->str() == ")")

ftok = ftok->link();

ftok = ftok->previous();

}

if (!ftok || !ftok->previous())

continue;

std::list<const Token *> varlist;

parseFunctionCall(*ftok->previous(), varlist, &_settings->library, 0);

if (std::find(varlist.begin(), varlist.end(), tok) != varlist.end()) {

if (value->condition == nullptr)

nullPointerError(tok, tok->str(), false, value->defaultArg, !value->isKnown());

else if (printWarnings)

nullPointerError(tok, tok->str(), value->condition, value->inconclusive);

}

continue;

}

// Pointer dereference.

bool unknown = false;

if (!isPointerDeRef(tok,unknown)) {

if (printInconclusive && unknown) {

if (value->condition == nullptr)

nullPointerError(tok, tok->str(), true, value->defaultArg, !value->isKnown());

else

nullPointerError(tok, tok->str(), value->condition, true);

}

continue;

}

if (value->condition == nullptr)

nullPointerError(tok, tok->str(), value->inconclusive, value->defaultArg, !value->isKnown());

else if (printWarnings)

nullPointerError(tok, tok->str(), value->condition, value->inconclusive);

}

{

nullPointerLinkedList();

nullPointerByDeRefAndChec();

{

const SymbolDatabase *symbolDatabase = _tokenizer->getSymbolDatabase();

const std::size_t functions = symbolDatabase->functionScopes.size();

for (std::size_t i = 0; i < functions; ++i) {

const Scope * scope = symbolDatabase->functionScopes[i];

if (scope->function == 0 || !scope->function->hasBody()) // We only look for functions with a body

continue;

const Token *tok = scope->classStart;

if (scope->function && scope->function->isConstructor())

tok = scope->function->token; // Check initialization list

for (; tok != scope->classEnd; tok = tok->next()) {

if (Token::Match(tok, "sizeof|decltype|typeid|typeof ("))

tok = tok->next()->link();

else if (Token::simpleMatch(tok, "* 0")) {

if (Token::Match(tok->previous(), "return|throw|;|{|}|:|[|(|,") || tok->previous()->isOp()) {

nullPointerError(tok);

}

}

else if (Token::Match(tok, "0 [") && (tok->previous()->str() != "&" || !Token::Match(tok->next()->link()->next(), "[.(]")))

nullPointerError(tok);

else if (Token::Match(tok->previous(), "!!. %name% (") && (tok->previous()->str() != "::" || tok->strAt(-2) == "std")) {

if (Token::simpleMatch(tok->tokAt(2), "0 )") && tok->varId()) { // constructor call

const Variable *var = tok->variable();

if (var && !var->isPointer() && !var->isArray() && var->isStlStringType())

nullPointerError(tok);

} else { // function call

std::list<const Token *> var;

parseFunctionCall(*tok, var, &_settings->library, 0);

// is one of the var items a NULL pointer?

for (std::list<const Token *>::const_iterator it = var.begin(); it != var.end(); ++it) {

if (Token::Match(*it, "0|NULL [,)]")) {

nullPointerError(*it);

}

}

}

} else if (Token::Match(tok, "std :: string|wstring ( 0 )"))

nullPointerError(tok);

else if (Token::simpleMatch(tok->previous(), ">> 0")) { // Only checking input stream operations is safe here, because otherwise 0 can be an integer as well

const Token* tok2 = tok->previous(); // Find start of statement

for (; tok2; tok2 = tok2->previous()) {

if (Token::Match(tok2->previous(), ";|{|}|:|("))

break;

}

if (tok2 && tok2->previous() && tok2->previous()->str()=="(")

continue;

if (Token::simpleMatch(tok2, "std :: cin"))

nullPointerError(tok);

if (tok2 && tok2->varId() != 0) {

const Variable *var = tok2->variable();

if (var && var->isStlType(stl_istream))

nullPointerError(tok);

}

}

const Variable *ovar = nullptr;

const Token *tokNull = nullptr;

if (Token::Match(tok, "0 ==|!=|>|>=|<|<= %var%")) {

if (!Token::Match(tok->tokAt(3),".|[")) {

ovar = tok->tokAt(2)->variable();

tokNull = tok;

}

} else if (Token::Match(tok, "%var% ==|!=|>|>=|<|<= 0") ||

Token::Match(tok, "%var% =|+ 0 )|]|,|;|+")) {

ovar = tok->variable();

tokNull = tok->tokAt(2);

}

if (ovar && !ovar->isPointer() && !ovar->isArray() && ovar->isStlStringType() && tokNull && tokNull->originalName() != "'\\0'")

nullPointerError(tokNull);

}

}

{

if (defaultArg) {

if (_settings->isEnabled("warning"))

reportError(tok, Severity::warning, "nullPointerDefaultArg", "Possible null pointer dereference if the default parameter value is used: " + varname, CWE476, inconclusive);

} else if (possible) {

if (_settings->isEnabled("warning"))

reportError(tok, Severity::warning, "nullPointer", "Possible null pointer dereference: " + varname, CWE476, inconclusive);

} else

reportError(tok, Severity::error, "nullPointer", "Null pointer dereference: " + varname, CWE476, inconclusive);

{

std::list<const Token*> callstack;

callstack.push_back(tok);

callstack.push_back(nullCheck);

const std::string errmsg(ValueFlow::eitherTheConditionIsRedundant(nullCheck) + " or there is possible null pointer dereference: " + varname + ".");

reportError(callstack, Severity::warning, "nullPointerRedundantCheck", errmsg, CWE476, inconclusive);