@@ -355,10 +355,77 @@ void CheckBufferOverrunImpl::arrayIndex()
355355 arrayIndexError (tok, dimensions, indexValues);
356356 }
357357
358+ const auto isNonnegativeInductionVariable = [&](const Token* indexToken) {
359+ const Variable* const variable = indexToken->variable ();
360+ if (!variable || !indexToken->varId ())
361+ return false ;
362+
363+ for (const Scope* loop = indexToken->scope (); loop; loop = loop->nestedIn ) {
364+ if (loop->type != ScopeType::eFor || !loop->classDef || !loop->bodyStart || !loop->bodyEnd )
365+ continue ;
366+ const Token* const forExpressions = loop->classDef ->next ();
367+ if (!forExpressions || !forExpressions->astOperand2 ())
368+ continue ;
369+ const Token* const clauses = forExpressions->astOperand2 ();
370+ const Token* const init = clauses->astOperand1 ();
371+ const Token* const remainingClauses = clauses->astOperand2 ();
372+ if (!init || !remainingClauses || !remainingClauses->astOperand1 () || !remainingClauses->astOperand2 ())
373+ continue ;
374+ const Token* const step = remainingClauses->astOperand2 ();
375+ if (!Token::simpleMatch (init, " =" astOperand1 () ||
376+ init->astOperand1 ()->varId () != indexToken->varId () || !Token::simpleMatch (step, " ++"
377+ continue ;
378+ const Token* stepVariable = step->astOperand1 ();
379+ if (!stepVariable)
380+ stepVariable = step->astOperand2 ();
381+ if (!stepVariable || stepVariable->varId () != indexToken->varId ())
382+ continue ;
383+
384+ const Token* const initialValue = init->astOperand2 ();
385+ const ValueType* const initialType = initialValue ? initialValue->valueType () : nullptr ;
386+ const ValueType* const indexType = indexToken->valueType ();
387+ if (!initialValue || !initialType || !indexType || !initialType->isIntegral () || !indexType->isIntegral () ||
388+ initialType->pointer || indexType->pointer || initialType->sign != indexType->sign ||
389+ initialType->getSizeOf (mSettings , ValueType::Accuracy::ExactOrZero, ValueType::SizeOf::Pointer) >
390+ indexType->getSizeOf (mSettings , ValueType::Accuracy::ExactOrZero, ValueType::SizeOf::Pointer))
391+ continue ;
392+ const bool hasNonnegativeLowerBound = std::any_of (initialValue->values ().cbegin (),
393+ initialValue->values ().cend (),
394+ [](const ValueFlow::Value& value) {
395+ return value.isIntValue () && !value.isImpossible () && !value.isInconclusive () && value.intvalue >= 0 &&
396+ (value.bound == ValueFlow::Value::Bound::Lower ||
397+ (value.bound == ValueFlow::Value::Bound::Point && value.isKnown ()));
398+ });
399+ if (!hasNonnegativeLowerBound)
400+ continue ;
401+ const Token* const condition = remainingClauses->astOperand1 ();
402+ if (findVariableChanged (previousBeforeAstLeftmostLeaf (condition)->next (),
403+ nextAfterAstRightmostLeaf (condition),
404+ /* indirect*/ 0 ,
405+ variable->declarationId (),
406+ variable->isGlobal (),
407+ mSettings ))
408+ continue ;
409+ if (findVariableChanged (loop->bodyStart ->next (),
410+ loop->bodyEnd ,
411+ /* indirect*/ 1 ,
412+ variable->declarationId (),
413+ variable->isGlobal (),
414+ mSettings ))
415+ continue ;
416+ return true ;
417+ }
418+ return false ;
419+ };
420+
358421 // Negative index
359422 bool neg = false ;
360423 std::vector<ValueFlow::Value> negativeIndexes;
361424 for (const Token * indexToken : indexTokens) {
425+ if (isNonnegativeInductionVariable (indexToken)) {
426+ negativeIndexes.emplace_back (ValueFlow::Value::unknown ());
427+ continue ;
428+ }
362429 const ValueFlow::Value *negativeValue = indexToken->getValueLE (-1 , mSettings );
363430 if (negativeValue) {
364431 negativeIndexes.emplace_back (*negativeValue);
0 commit comments