{

if (!mSettings->isEnabled(Settings::WARNING))

return;

const SymbolDatabase *symbolDatabase = mTokenizer->getSymbolDatabase();

for (const Scope * scope : symbolDatabase->functionScopes) {

std::map<unsigned int, std::string> vars;

for (const Token* tok = scope->bodyStart->next(); tok != scope->bodyEnd; tok = tok->next()) {

// Quick check to see if any of the matches below have any chances

if (!Token::Match(tok, "%var%|EOF %comp%|="))

continue;

if (Token::Match(tok, "%var% = fclose|fflush|fputc|fputs|fscanf|getchar|getc|fgetc|putchar|putc|puts|scanf|sscanf|ungetc (")) {

const Variable *var = tok->variable();

if (var && var->typeEndToken()->str() == "char" && !var->typeEndToken()->isSigned()) {

vars[tok->varId()] = tok->strAt(2);

}

} else if (Token::Match(tok, "EOF %comp% ( %var% = fclose|fflush|fputc|fputs|fscanf|getchar|getc|fgetc|putchar|putc|puts|scanf|sscanf|ungetc (")) {

tok = tok->tokAt(3);

const Variable *var = tok->variable();

if (var && var->typeEndToken()->str() == "char" && !var->typeEndToken()->isSigned()) {

checkCastIntToCharAndBackError(tok, tok->strAt(2));

}

} else if (mTokenizer->isCPP() && (Token::Match(tok, "EOF %comp% ( %var% = std :: cin . get (") || Token::Match(tok, "EOF %comp% ( %var% = cin . get ("))) {

tok = tok->tokAt(3);

const Variable *var = tok->variable();

if (var && var->typeEndToken()->str() == "char" && !var->typeEndToken()->isSigned()) {

checkCastIntToCharAndBackError(tok, "cin.get");

}

} else if (mTokenizer->isCPP() && (Token::Match(tok, "%var% = std :: cin . get (") || Token::Match(tok, "%var% = cin . get ("))) {

const Variable *var = tok->variable();

if (var && var->typeEndToken()->str() == "char" && !var->typeEndToken()->isSigned()) {

vars[tok->varId()] = "cin.get";

}

} else if (Token::Match(tok, "%var% %comp% EOF")) {

if (vars.find(tok->varId()) != vars.end()) {

checkCastIntToCharAndBackError(tok, vars[tok->varId()]);

}

} else if (Token::Match(tok, "EOF %comp% %var%")) {

tok = tok->tokAt(2);

if (vars.find(tok->varId()) != vars.end()) {

checkCastIntToCharAndBackError(tok, vars[tok->varId()]);

}

}

}

}

{

reportError(

tok,

Severity::warning,

"checkCastIntToCharAndBack",

"$symbol:" + strFunctionName + "\n"

"Storing $symbol() return value in char variable and then comparing with EOF.\n"

"When saving $symbol() return value in char variable there is loss of precision. "

" When $symbol() returns EOF this value is truncated. Comparing the char "

"variable with EOF can have unexpected results. For instance a loop \"while (EOF != (c = $symbol());\" "

"loops forever on some compilers/platforms and on other compilers/platforms it will stop "

"when the file contains a matching character.", CWE197, false

);

{

if (!mSettings->isEnabled(Settings::STYLE))

return;

const SymbolDatabase *symbolDatabase = mTokenizer->getSymbolDatabase();

for (const Scope * scope : symbolDatabase->functionScopes) {

for (const Token* tok = scope->bodyStart->next(); tok != scope->bodyEnd; tok = tok->next()) {

// ? operator where lhs is arithmetical expression

if (tok->str() != "?" || !tok->astOperand1() || !tok->astOperand1()->isCalculation())

continue;

if (!tok->astOperand1()->isArithmeticalOp() && tok->astOperand1()->tokType() != Token::eBitOp)

continue;

// Is code clarified by parentheses already?

const Token *tok2 = tok->astOperand1();

for (; tok2; tok2 = tok2->next()) {

if (tok2->str() == "(")

tok2 = tok2->link();

else if (tok2->str() == ")")

break;

else if (tok2->str() == "?") {

clarifyCalculationError(tok, tok->astOperand1()->str());

break;

}

}

}

}

{

// suspicious calculation

const std::string calc("'a" + op + "b?c:d'");

// recommended calculation #1

const std::string s1("'(a" + op + "b)?c:d'");

// recommended calculation #2

const std::string s2("'a" + op + "(b?c:d)'");

reportError(tok,

Severity::style,

"clarifyCalculation",

"Clarify calculation precedence for '" + op + "' and '?'.\n"

"Suspicious calculation. Please use parentheses to clarify the code. "

"The code '" + calc + "' should be written as either '" + s1 + "' or '" + s2 + "'.", CWE783, false);

{

if (!mSettings->isEnabled(Settings::WARNING))

return;

const SymbolDatabase *symbolDatabase = mTokenizer->getSymbolDatabase();

for (const Scope * scope : symbolDatabase->functionScopes) {

for (const Token* tok = scope->bodyStart; tok && tok != scope->bodyEnd; tok = tok->next()) {

if (Token::Match(tok, "* %name%") && tok->astOperand1()) {

const Token *tok2 = tok->previous();

while (tok2 && tok2->str() == "*")

tok2 = tok2->previous();

if (tok2 && !tok2->astParent() && Token::Match(tok2, "[{};]")) {

tok2 = tok->astOperand1();

if (Token::Match(tok2, "++|-- [;,]"))

clarifyStatementError(tok2);

}

}

}

}

{

reportError(tok, Severity::warning, "clarifyStatement", "Ineffective statement similar to '*A++;'. Did you intend to write '(*A)++;'?\n"

"A statement like '*A++;' might not do what you intended. Postfix 'operator++' is executed before 'operator*'. "

"Thus, the dereference is meaningless. Did you intend to write '(*A)++;'?", CWE783, false);

{

if (!mSettings->inconclusive || !mSettings->isEnabled(Settings::WARNING))

return;

const SymbolDatabase* const symbolDatabase = mTokenizer->getSymbolDatabase();

// Look for "if(); {}", "for(); {}" or "while(); {}"

for (const Scope &scope : symbolDatabase->scopeList) {

if (scope.type == Scope::eIf || scope.type == Scope::eElse || scope.type == Scope::eWhile || scope.type == Scope::eFor) {

// Ensure the semicolon is at the same line number as the if/for/while statement

// and the {..} block follows it without an extra empty line.

if (Token::simpleMatch(scope.bodyStart, "{ ; } {") &&

scope.bodyStart->previous()->linenr() == scope.bodyStart->tokAt(2)->linenr()

&& scope.bodyStart->linenr()+1 >= scope.bodyStart->tokAt(3)->linenr()) {

SuspiciousSemicolonError(scope.classDef);

}

}

}

{

reportError(tok, Severity::warning, "suspiciousSemicolon",

"Suspicious use of ; at the end of '" + (tok ? tok->str() : std::string()) + "' statement.", CWE398, true);

{

// Only valid on C++ code

if (!mSettings->isEnabled(Settings::STYLE) || !mTokenizer->isCPP())

return;

const SymbolDatabase *symbolDatabase = mTokenizer->getSymbolDatabase();

for (const Scope * scope : symbolDatabase->functionScopes) {

const Token* tok;

if (scope->function && scope->function->isConstructor())

tok = scope->classDef;

else

tok = scope->bodyStart;

for (; tok && tok != scope->bodyEnd; tok = tok->next()) {

// Old style pointer casting..

if (!Token::Match(tok, "( const|volatile| const|volatile| %type% * const| ) (| %name%|%num%|%bool%|%char%|%str%"))

continue;

// skip first "const" in "const Type* const"

while (Token::Match(tok->next(), "const|volatile"))

tok = tok->next();

const Token* typeTok = tok->next();

// skip second "const" in "const Type* const"

if (tok->strAt(3) == "const")

tok = tok->next();

const Token *p = tok->tokAt(4);

if (p->hasKnownIntValue() && p->values().front().intvalue==0) // Casting nullpointers is safe

continue;

// Is "type" a class?

if (typeTok->type())

cstyleCastError(tok);

}

}

{

reportError(tok, Severity::style, "cstyleCast",

"C-style pointer casting\n"

"C-style pointer casting detected. C++ offers four different kinds of casts as replacements: "

"static_cast, const_cast, dynamic_cast and reinterpret_cast. A C-style cast could evaluate to "

"any of those automatically, thus it is considered safer if the programmer explicitly states "

"which kind of cast is expected. See also: https://www.securecoding.cert.org/confluence/display/cplusplus/EXP05-CPP.+Do+not+use+C-style+casts.", CWE398, false);

{

if (!mSettings->isEnabled(Settings::PORTABILITY))

return;

const bool printInconclusive = mSettings->inconclusive;

const SymbolDatabase* const symbolDatabase = mTokenizer->getSymbolDatabase();

for (const Scope * scope : symbolDatabase->functionScopes) {

for (const Token* tok = scope->bodyStart->next(); tok != scope->bodyEnd; tok = tok->next()) {

const Token* toTok = nullptr;

const Token* fromTok = nullptr;

// Find cast

if (Token::Match(tok, "( const|volatile| const|volatile| %type% %type%| const| * )")) {

toTok = tok;

fromTok = tok->astOperand1();

} else if (Token::simpleMatch(tok, "reinterpret_cast <") && tok->linkAt(1)) {

toTok = tok->linkAt(1)->next();

fromTok = toTok->astOperand2();

}

if (!fromTok)

continue;

const ValueType* fromType = fromTok->valueType();

const ValueType* toType = toTok->valueType();

if (!fromType || !toType || !fromType->pointer || !toType->pointer)

continue;

if (fromType->type != toType->type && fromType->type >= ValueType::Type::BOOL && toType->type >= ValueType::Type::BOOL && (toType->type != ValueType::Type::CHAR || printInconclusive)) {

if (toType->isIntegral() && fromType->isIntegral())

continue;

std::string toStr = toType->isIntegral() ? "integer *" : toType->str();

toStr.erase(toStr.size()-2);

std::string fromStr = fromType->isIntegral() ? "integer *" : fromType->str();

fromStr.erase(fromStr.size() - 2);

invalidPointerCastError(tok, fromStr, toStr, toType->type == ValueType::Type::CHAR);

}

}

}

{

if (to == "integer") { // If we cast something to int*, this can be useful to play with its binary data representation

if (!inconclusive)

reportError(tok, Severity::portability, "invalidPointerCast", "Casting from " + from + "* to integer* is not portable due to different binary data representations on different platforms.", CWE704, false);

else

reportError(tok, Severity::portability, "invalidPointerCast", "Casting from " + from + "* to char* is not portable due to different binary data representations on different platforms.", CWE704, true);

} else

reportError(tok, Severity::portability, "invalidPointerCast", "Casting between " + from + "* and " + to + "* which have an incompatible binary data representation.", CWE704, false);

{

if (!mSettings->standards.posix)

return;

const SymbolDatabase *symbolDatabase = mTokenizer->getSymbolDatabase();

for (const Scope * scope : symbolDatabase->functionScopes) {

for (const Token* tok = scope->bodyStart->next(); tok != scope->bodyEnd; tok = tok->next()) {

if (Token::Match(tok, "pipe ( %var% )") ||

Token::Match(tok, "pipe2 ( %var% ,")) {

const Token * const varTok = tok->tokAt(2);

const Variable *var = varTok->variable();

MathLib::bigint dim;

if (var && var->isArray() && !var->isArgument() && ((dim=var->dimension(0U)) < 2)) {

const std::string strDim = MathLib::toString(dim);

checkPipeParameterSizeError(varTok,varTok->str(), strDim);

}

}

}

}

{

reportError(tok, Severity::error,

"wrongPipeParameterSize",

"$symbol:" + strVarName + "\n"

"Buffer '$symbol' must have size of 2 integers if used as parameter of pipe().\n"

"The pipe()/pipe2() system command takes an argument, which is an array of exactly two integers.\n"

"The variable '$symbol' is an array of size " + strDim + ", which does not match.", CWE686, false);

{

if (var && var->isVolatile())

return false;

return nonLocal(var);

{

for (std::map<unsigned int, const Token*>::iterator i = container.begin(); i != container.end();) {

const Variable* var = symbolDatabase->getVariableFromVarId(i->first);

if (!var || nonLocal(var)) {

container.erase(i++);

} else

++i;

}

{

const std::map<unsigned int, std::set<unsigned int> >::const_iterator it = membervars.find(varId);

if (it != membervars.end()) {

const std::set<unsigned int>& vars = it->second;

for (unsigned int var : vars) {

varAssignments.erase(var);

if (var != varId)

eraseMemberAssignments(var, membervars, varAssignments);

}

}

{

const Variable* var = tok->variable();

const Scope* upperScope = tok->scope();

if (var && upperScope == var->scope())

return true;

while (upperScope && upperScope->type != Scope::eTry && upperScope->type != Scope::eLambda && (!var || upperScope->nestedIn != var->scope()) && upperScope->isExecutable()) {

upperScope = upperScope->nestedIn;

}

if (var && upperScope && upperScope->type == Scope::eTry) {

// Check all exception han

const Token* tok2 = upperScope->bodyEnd;

while (Token::simpleMatch(tok2, "} catch (")) {

tok2 = tok2->linkAt(2)->next();

if (Token::findmatch(tok2, "%varid%", tok2->link(), var->declarationId()))

return false;

tok2 = tok2->link();

}

}

return true;

{

const bool printPerformance = mSettings->isEnabled(Settings::PERFORMANCE);

const bool printStyle = mSettings->isEnabled(Settings::STYLE);

const bool printWarning = mSettings->isEnabled(Settings::WARNING);

if (!printWarning && !printPerformance && !printStyle)

return;

const bool printInconclusive = mSettings->inconclusive;

const SymbolDatabase* symbolDatabase = mTokenizer->getSymbolDatabase();

for (const Scope &scope : symbolDatabase->scopeList) {

if (!scope.isExecutable())

continue;

std::map<unsigned int, const Token*> varAssignments;

std::map<unsigned int, const Token*> memAssignments;

std::map<unsigned int, std::set<unsigned int> > membervars;

std::set<unsigned int> initialized;

const Token* writtenArgumentsEnd = nullptr;

for (const Token* tok = scope.bodyStart->next(); tok && tok != scope.bodyEnd; tok = tok->next()) {

if (tok == writtenArgumentsEnd)

writtenArgumentsEnd = nullptr;

if (tok->str() == "?" && tok->astOperand2()) {

tok = Token::findmatch(tok->astOperand2(), ";|}");

if (!tok)

break;

varAssignments.clear();

memAssignments.clear();

} else if (tok->str() == "{" && tok->strAt(-1) != "{" && tok->strAt(-1) != "=" && tok->strAt(-4) != "case" && tok->strAt(-3) != "default") { // conditional or non-executable inner scope: Skip it and reset status

tok = tok->link();

varAssignments.clear();

memAssignments.clear();

} else if (Token::Match(tok, "for|if|while (")) {

tok = tok->linkAt(1);

} else if (Token::Match(tok, "break|return|continue|throw|goto|asm")) {

varAssignments.clear();

memAssignments.clear();

} else if (tok->tokType() == Token::eVariable && !Token::Match(tok, "%name% (")) {

const Token *eq = nullptr;

for (const Token *tok2 = tok; tok2; tok2 = tok2->next()) {

if (Token::Match(tok2, "[([]")) {

// bail out if there is a variable in rhs - we only track 1 variable

bool bailout = false;

for (const Token *tok3 = tok2->link(); tok3 != tok2; tok3 = tok3->previous()) {

if (tok3->varId()) {

const Variable *var = tok3->variable();

if (!var || !var->isConst() || var->isReference() || var->isPointer()) {

bailout = true;

break;

}

}

}

if (bailout)

break;

tok2 = tok2->link();

} else if (Token::Match(tok2, "[)];,]"))

break;

else if (tok2->str() == "=") {

eq = tok2;

break;

}

}

// Set initialization flag

if (!Token::Match(tok, "%var% ["))

initialized.insert(tok->varId());

else {

const Token *tok2 = tok->next();

while (tok2 && tok2->str() == "[")

tok2 = tok2->link()->next();

if (tok2 && tok2->str() != ";")

initialized.insert(tok->varId());

}

const Token *startToken = tok;

while (Token::Match(startToken, "%name%|::|.")) {

startToken = startToken->previous();

if (Token::Match(startToken, "%name% . %var%"))

membervars[startToken->varId()].insert(startToken->tokAt(2)->varId());

}

const std::map<unsigned int, const Token*>::iterator it = varAssignments.find(tok->varId());

if (eq && Token::Match(startToken, "[;{}]")) { // Assignment

if (it != varAssignments.end()) {

const Token *oldeq = nullptr;

for (const Token *tok2 = it->second; tok2; tok2 = tok2->next()) {

if (Token::Match(tok2, "[([]"))

tok2 = tok2->link();

else if (Token::Match(tok2, "[)];,]"))

break;

else if (Token::Match(tok2, "++|--|=")) {

oldeq = tok2;

break;

}

}

if (!oldeq) {

const Token *tok2 = it->second;

while (Token::Match(tok2, "%name%|.|[|*|("))

tok2 = tok2->astParent();

if (Token::Match(tok2, "++|--"))

oldeq = tok2;

}

// Ensure that LHS in assignments are the same

bool error = oldeq && eq->astOperand1() && isSameExpression(mTokenizer->isCPP(), true, eq->astOperand1(), oldeq->astOperand1(), mSettings->library, true);

// Ensure that variable is not used on right side

std::stack<const Token *> tokens;

tokens.push(eq->astOperand2());

while (!tokens.empty()) {

const Token *rhs = tokens.top();

tokens.pop();

if (!rhs)

continue;

tokens.push(rhs->astOperand1());

tokens.push(rhs->astOperand2());

if (rhs->varId() == tok->varId()) {

error = false;

break;

}

if (Token::Match(rhs->previous(), "%name% (") && nonLocalVolatile(tok->variable())) { // Called function might use the variable

const Function* const func = rhs->function();

const Variable* const var = tok->variable();

if (!var || var->isGlobal() || var->isReference() || ((!func || func->nestedIn) && rhs->strAt(-1) != ".")) {// Global variable, or member function

error = false;

break;

}

}

}

if (error) {

if (printWarning && scope.type == Scope::eSwitch && Token::findmatch(it->second, "default|case", tok))

redundantAssignmentInSwitchError(it->second, tok, eq->astOperand1()->expressionString());

else if (printStyle) {

// c++, unknown type => assignment might have additional side effects

const bool possibleSideEffects(mTokenizer->isCPP() && !tok->valueType());

// TODO nonlocal variables are not tracked entirely.

const bool nonlocal = it->second->variable() && nonLocalVolatile(it->second->variable());

// Warnings are inconclusive if there are possible side effects or if variable is not

// tracked perfectly.

const bool inconclusive = possibleSideEffects | nonlocal;

if (printInconclusive || !inconclusive)

if (mTokenizer->isC() || checkExceptionHandling(tok)) // see #6555 to see how exception handling might have an impact

redundantAssignmentError(it->second, tok, eq->astOperand1()->expressionString(), inconclusive);

}

}

it->second = tok;

}

if (!Token::simpleMatch(tok->tokAt(2), "0 ;") || (tok->variable() && tok->variable()->nameToken() != tok->tokAt(-2)))

varAssignments[tok->varId()] = tok;

memAssignments.erase(tok->varId());

eraseMemberAssignments(tok->varId(), membervars, varAssignments);

} else if ((tok->next() && tok->next()->tokType() == Token::eIncDecOp) || (tok->previous()->tokType() == Token::eIncDecOp && tok->strAt(1) == ";")) { // Variable incremented/decremented; Prefix-Increment is only suspicious, if its return value is unused

varAssignments[tok->varId()] = tok;

memAssignments.erase(tok->varId());

eraseMemberAssignments(tok->varId(), membervars, varAssignments);

} else if (!Token::simpleMatch(tok->tokAt(-2), "sizeof (")) { // Other usage of variable

if (it != varAssignments.end())

varAssignments.erase(it);

if (!writtenArgumentsEnd) // Indicates that we are in the first argument of strcpy/memcpy/... function

memAssignments.erase(tok->varId());

}

} else if (Token::Match(tok, "%name% (") && !mSettings->library.isFunctionConst(tok->str(), true)) { // Function call. Global variables might be used. Reset their status

const bool memfunc = Token::Match(tok, "memcpy|memmove|memset|strcpy|strncpy|sprintf|snprintf|strcat|strncat|wcscpy|wcsncpy|swprintf|wcscat|wcsncat");

if (tok->varId()) // operator() or function pointer

varAssignments.erase(tok->varId());

if (memfunc && tok->strAt(-1) != "(" && tok->strAt(-1) != "=") {

const Token* param1 = tok->tokAt(2);

writtenArgumentsEnd = param1->next();

if (param1->varId() && param1->strAt(1) == "," && !Token::Match(tok, "strcat|strncat|wcscat|wcsncat") && param1->variable() && param1->variable()->isLocal() && param1->variable()->isArray()) {

if (tok->str() == "memset" && initialized.find(param1->varId()) == initialized.end())

initialized.insert(param1->varId());

else {

const std::map<unsigned int, const Token*>::const_iterator it = memAssignments.find(param1->varId());

if (it == memAssignments.end())

memAssignments[param1->varId()] = tok;

else {

bool read = false;

for (const Token *tok2 = tok->linkAt(1); tok2 != writtenArgumentsEnd; tok2 = tok2->previous()) {

if (tok2->varId() == param1->varId()) {

// TODO: is this a read? maybe it's a write

read = true;

break;

}

}

if (read) {

memAssignments[param1->varId()] = tok;

continue;

}

if (printWarning && scope.type == Scope::eSwitch && Token::findmatch(it->second, "default|case", tok))

redundantCopyInSwitchError(it->second, tok, param1->str());

else if (printPerformance)

redundantCopyError(it->second, tok, param1->str());

}

}

}

} else if (scope.type == Scope::eSwitch) { // Avoid false positives if noreturn function is called in switch

const Function* const func = tok->function();

if (!func || !func->hasBody()) {

varAssignments.clear();

memAssignments.clear();

continue;

}

const Token* funcEnd = func->functionScope->bodyEnd;

bool noreturn;

if (!mTokenizer->IsScopeNoReturn(funcEnd, &noreturn) && !noreturn) {

eraseNotLocalArg(varAssignments, symbolDatabase);

eraseNotLocalArg(memAssignments, symbolDatabase);

} else {

varAssignments.clear();

memAssignments.clear();

}

} else { // Noreturn functions outside switch don't cause problems

eraseNotLocalArg(varAssignments, symbolDatabase);

eraseNotLocalArg(memAssignments, symbolDatabase);

}

}

}

}

{

const std::list<const Token *> callstack = { tok1, tok2 };

reportError(callstack, Severity::performance, "redundantCopy",

"$symbol:" + var + "\n"

"Buffer '$symbol' is being written before its old content has been used.", CWE563, false);

{

const std::list<const Token *> callstack = { tok1, tok2 };

reportError(callstack, Severity::warning, "redundantCopyInSwitch",

"$symbol:" + var + "\n"

"Buffer '$symbol' is being written before its old content has been used. 'break;' missing?", CWE563, false);

{

const std::list<const Token *> callstack = { tok1, tok2 };

if (inconclusive)

reportError(callstack, Severity::style, "redundantAssignment",

"$symbol:" + var + "\n"

"Variable '$symbol' is reassigned a value before the old one has been used if variable is no semaphore variable.\n"

"Variable '$symbol' is reassigned a value before the old one has been used. Make sure that this variable is not used like a semaphore in a threading environment before simplifying this code.", CWE563, true);

else

reportError(callstack, Severity::style, "redundantAssignment",

"$symbol:" + var + "\n"

"Variable '$symbol' is reassigned a value before the old one has been used.", CWE563, false);

{

const std::list<const Token *> callstack = { tok1, tok2 };

reportError(callstack, Severity::warning, "redundantAssignInSwitch",

"$symbol:" + var + "\n"

"Variable '$symbol' is reassigned a value before the old one has been used. 'break;' missing?", CWE563, false);

{

if (Token::Match(tok, "%name% (") || Token::Match(tok, "break|continue|return|exit|goto|throw"))

return true;

return false;

{

if (!mSettings->isEnabled(Settings::WARNING))

return;

const SymbolDatabase *symbolDatabase = mTokenizer->getSymbolDatabase();

// Find the beginning of a switch. E.g.:

// switch (var) { ...

for (const Scope &switchScope : symbolDatabase->scopeList) {

if (switchScope.type != Scope::eSwitch || !switchScope.bodyStart)

continue;

// Check the contents of the switch statement

std::map<unsigned int, const Token*> varsWithBitsSet;

std::map<unsigned int, std::string> bitOperations;

for (const Token *tok2 = switchScope.bodyStart->next(); tok2 != switchScope.bodyEnd; tok2 = tok2->next()) {

if (tok2->str() == "{") {

// Inside a conditional or loop. Don't mark variable accesses as being redundant. E.g.:

// case 3: b = 1;

// case 4: if (a) { b = 2; } // Doesn't make the b=1 redundant because it's conditional

if (Token::Match(tok2->previous(), ")|else {") && tok2->link()) {

const Token* endOfConditional = tok2->link();

for (const Token* tok3 = tok2; tok3 != endOfConditional; tok3 = tok3->next()) {

if (tok3->varId() != 0) {

varsWithBitsSet.erase(tok3->varId());

bitOperations.erase(tok3->varId());

} else if (isFunctionOrBreakPattern(tok3)) {

varsWithBitsSet.clear();

bitOperations.clear();

}

}

tok2 = endOfConditional;

}

}

// Variable assignment. Report an error if it's assigned to twice before a break. E.g.:

// case 3: b = 1; // <== redundant

// case 4: b = 2;

if (Token::Match(tok2->previous(), ";|{|}|: %var% = %any% ;")) {

varsWithBitsSet.erase(tok2->varId());

bitOperations.erase(tok2->varId());

}

// Bitwise operation. Report an error if it's performed twice before a break. E.g.:

// case 3: b |= 1; // <== redundant

// case 4: b |= 1;

else if (Token::Match(tok2->previous(), ";|{|}|: %var% %assign% %num% ;") &&

(tok2->strAt(1) == "|=" || tok2->strAt(1) == "&=") &&

Token::Match(tok2->next()->astOperand2(), "%num%")) {

const std::string bitOp = tok2->strAt(1)[0] + tok2->strAt(2);

const std::map<unsigned int, const Token*>::const_iterator i2 = varsWithBitsSet.find(tok2->varId());

// This variable has not had a bit operation performed on it yet, so just make a note of it

if (i2 == varsWithBitsSet.end()) {

varsWithBitsSet[tok2->varId()] = tok2;

bitOperations[tok2->varId()] = bitOp;

}

// The same bit operation has been performed on the same variable twice, so report an error

else if (bitOperations[tok2->varId()] == bitOp)

redundantBitwiseOperationInSwitchError(i2->second, i2->second->str());

// A different bit operation was performed on the variable, so clear it

else {

varsWithBitsSet.erase(tok2->varId());

bitOperations.erase(tok2->varId());

}

}

// Bitwise operation. Report an error if it's performed twice before a break. E.g.:

// case 3: b = b | 1; // <== redundant

// case 4: b = b | 1;

else if (Token::Match(tok2->previous(), ";|{|}|: %var% = %name% %or%|& %num% ;") &&

tok2->varId() == tok2->tokAt(2)->varId()) {

const std::string bitOp = tok2->strAt(3) + tok2->strAt(4);

const std::map<unsigned int, const Token*>::const_iterator i2 = varsWithBitsSet.find(tok2->varId());

// This variable has not had a bit operation performed on it yet, so just make a note of it

if (i2 == varsWithBitsSet.end()) {

varsWithBitsSet[tok2->varId()] = tok2;

bitOperations[tok2->varId()] = bitOp;

}

// The same bit operation has been performed on the same variable twice, so report an error

else if (bitOperations[tok2->varId()] == bitOp)

redundantBitwiseOperationInSwitchError(i2->second, i2->second->str());

// A different bit operation was performed on the variable, so clear it

else {

varsWithBitsSet.erase(tok2->varId());

bitOperations.erase(tok2->varId());

}

}

// Not a simple assignment so there may be good reason if this variable is assigned to twice. E.g.:

// case 3: b = 1;

// case 4: b++;

else if (tok2->varId() != 0 && tok2->strAt(1) != "|" && tok2->strAt(1) != "&") {

varsWithBitsSet.erase(tok2->varId());

bitOperations.erase(tok2->varId());

}

// Reset our record of assignments if there is a break or function call. E.g.:

// case 3: b = 1; break;

if (isFunctionOrBreakPattern(tok2)) {

varsWithBitsSet.clear();

bitOperations.clear();

}

}

}

{

reportError(tok, Severity::warning,

"redundantBitwiseOperationInSwitch",

"$symbol:" + varname + "\n"

"Redundant bitwise operation on '$symbol' in 'switch' statement. 'break;' missing?");

{

if (!mSettings->inconclusive || !mSettings->isEnabled(Settings::WARNING))

return;

const SymbolDatabase *symbolDatabase = mTokenizer->getSymbolDatabase();

for (const Scope & scope : symbolDatabase->scopeList) {

if (scope.type != Scope::eSwitch)

continue;

for (const Token* tok = scope.bodyStart->next(); tok != scope.bodyEnd; tok = tok->next()) {

if (tok->str() == "case") {

const Token* finding = nullptr;

for (const Token* tok2 = tok->next(); tok2; tok2 = tok2->next()) {

if (tok2->str() == ":")

break;

if (Token::Match(tok2, "[;}{]"))

break;

if (tok2->str() == "?")

finding = nullptr;

else if (Token::Match(tok2, "&&|%oror%"))

finding = tok2;

}

if (finding)

suspiciousCaseInSwitchError(finding, finding->str());

}

}

}

{

reportError(tok, Severity::warning, "suspiciousCase",

"Found suspicious case label in switch(). Operator '" + operatorString + "' probably doesn't work as intended.\n"

"Using an operator like '" + operatorString + "' in a case label is suspicious. Did you intend to use a bitwise operator, multiple case labels or if/else instead?", CWE398, true);

{

if (!mSettings->isEnabled(Settings::WARNING) || !mSettings->inconclusive)

return;

const SymbolDatabase* symbolDatabase = mTokenizer->getSymbolDatabase();

for (const Scope * scope : symbolDatabase->functionScopes) {

for (const Token* tok = scope->bodyStart; tok != scope->bodyEnd; tok = tok->next()) {

if (Token::simpleMatch(tok, "for (")) {

const Token* const openParen = tok->next();

const Token* const closeParen = tok->linkAt(1);

// Search for any suspicious equality comparison in the initialization

// or increment-decrement parts of the for() loop.

// For example:

// for (i == 2; i < 10; i++)

// or

// for (i = 0; i < 10; i == a)

if (Token::Match(openParen->next(), "%name% =="))

suspiciousEqualityComparisonError(openParen->tokAt(2));

if (closeParen->strAt(-2) == "==")

suspiciousEqualityComparisonError(closeParen->tokAt(-2));

// Skip over for() loop conditions because "for (;running==1;)"

// is a bit strange, but not necessarily incorrect.

tok = closeParen;

} else if (Token::Match(tok, "[;{}] *| %name% == %any% ;")) {

// Exclude compound statements surrounded by parentheses, such as

// printf("%i\n", ({x==0;}));

// because they may appear as an expression in GNU C/C++.

// See http://gcc.gnu.org/onlinedocs/gcc/Statement-Exprs.html

const Token* afterStatement = tok->strAt(1) == "*" ? tok->tokAt(6) : tok->tokAt(5);

if (!Token::simpleMatch(afterStatement, "} )"))

suspiciousEqualityComparisonError(tok->next());

}

}

}

{

reportError(tok, Severity::warning, "suspiciousEqualityComparison",

"Found suspicious equality comparison. Did you intend to assign a value instead?", CWE482, true);

{

if (!mSettings->isEnabled(Settings::STYLE))

return;

const bool printInconclusive = mSettings->inconclusive;

const SymbolDatabase* symbolDatabase = mTokenizer->getSymbolDatabase();

for (const Scope * scope : symbolDatabase->functionScopes) {

for (const Token* tok = scope->bodyStart; tok && tok != scope->bodyEnd; tok = tok->next()) {

const Token* secondBreak = nullptr;

const Token* labelName = nullptr;

if (tok->link() && Token::Match(tok, "(|[|<"))

tok = tok->link();

else if (Token::Match(tok, "break|continue ;"))

secondBreak = tok->tokAt(2);

else if (Token::Match(tok, "[;{}:] return|throw")) {

tok = tok->next(); // tok should point to return or throw

for (const Token *tok2 = tok->next(); tok2; tok2 = tok2->next()) {

if (tok2->str() == "(" || tok2->str() == "{")

tok2 = tok2->link();

if (tok2->str() == ";") {