Skip to content

Fix #14891 FP knownConditionTrueFalse (dereferencing pointer to array member)#8704

Open
chrchr-github wants to merge 5 commits into
cppcheck-opensource:mainfrom
chrchr-github:chr_14891
Open

Fix #14891 FP knownConditionTrueFalse (dereferencing pointer to array member)#8704
chrchr-github wants to merge 5 commits into
cppcheck-opensource:mainfrom
chrchr-github:chr_14891

Conversation

@chrchr-github

@chrchr-github chrchr-github commented Jul 7, 2026

Copy link
Copy Markdown
Collaborator

No description provided.

danmar
danmar previously approved these changes Jul 9, 2026
View reviewed changes
@chrchr-github

chrchr-github commented Jul 9, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator Author

@pfultz2 Please review, I'm not entirely sure this is the right fix.

@pfultz2

pfultz2 commented Jul 9, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Yea this is not the right fix. The correct fix should be in valueFlowSymbolic. There are a couple of issue here.

First const int* p = a should not create a symbolic value. We have checks in valueFlowSymbolic for different types and implicit conversions and it needs to be updated to skip for decaying arrays as well.

Secondly, the lifetime of p shows lifetime[Object]=(a) but it would be better if it was lifetime[Address]=(a). Its probably not necessary to fix for this FP, but its something I noticed with the valueflow output.

@chrchr-github
chrchr-github marked this pull request as draft July 10, 2026 14:01
github-advanced-security[bot]
github-advanced-security AI found potential problems Jul 13, 2026
View reviewed changes
Comment thread lib/valueflow.cpp Fixed
@chrchr-github
chrchr-github marked this pull request as ready for review July 13, 2026 08:54
@danmar

danmar commented Jul 24, 2026

Copy link
Copy Markdown
Collaborator

@pfultz2 I would appreciate one more review on this.

pfultz2
pfultz2 reviewed Jul 24, 2026
View reviewed changes
Comment thread lib/valueflow.cpp
continue;
if (tok->astOperand2()->exprId() == 0)
continue;
if (tok->astOperand2()->variable() && tok->astOperand2()->variable()->isArray() && tok->astOperand2()->variable()->getTypeName() != "std::array") // array to pointer decay

@pfultz2 pfultz2 Jul 24, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should also check its being assigned to a pointer: astIsPointer(tok->astOperand1()).

Also I dont really see the point in checking for std::array, and its probably better to not check just in case a future version of C++ add implicit conversions to support pointer-like decaying behavior.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@danmar danmar danmar left review comments
+2 more reviewers
@pfultz2 pfultz2 pfultz2 left review comments
@github-advanced-security github-advanced-security[bot] github-advanced-security[bot] left review comments
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@chrchr-github @pfultz2 @danmar @github-advanced-security