{

// What we may have...

// * var = (char *)malloc(10);

// * var = new char[10];

// * var = strdup("hello");

// * var = strndup("hello", 3);

if (tok2 && tok2->str() == "(") {

tok2 = tok2->link();

tok2 = tok2 ? tok2->next() : nullptr;

}

if (! tok2)

return No;

if (tok2->str() == "::")

tok2 = tok2->next();

if (! tok2->isName())

return No;

if (!Token::Match(tok2, "%name% ::|. %type%")) {

// Using realloc..

AllocType reallocType = getReallocationType(tok2, varid);

if (reallocType != No)

return reallocType;

if (mTokenizer_->isCPP() && tok2->str() == "new") {

if (tok2->strAt(1) == "(" && !Token::Match(tok2->next(),"( std| ::| nothrow )"))

return No;

if (tok2->astOperand1() && (tok2->astOperand1()->str() == "[" || (tok2->astOperand1()->astOperand1() && tok2->astOperand1()->astOperand1()->str() == "[")))

return NewArray;

const Token *typeTok = tok2->next();

while (Token::Match(typeTok, "%name% :: %name%"))

typeTok = typeTok->tokAt(2);

if (typeTok->type() && typeTok->type()->isClassType()) {

const Scope *classScope = typeTok->type()->classScope;

if (classScope && classScope->numConstructors > 0)

return No;

}

return New;

}

if (mSettings_->posix()) {

if (Token::Match(tok2, "open|openat|creat|mkstemp|mkostemp|socket (")) {

// simple sanity check of function parameters..

// TODO: Make such check for all these functions

const int num = numberOfArguments(tok2);

if (tok2->str() == "open" && num != 2 && num != 3)

return No;

// is there a user function with this name?

if (tok2->function())

return No;

return Fd;

}

if (Token::simpleMatch(tok2, "popen ("))

return Pipe;

}

// Does tok2 point on a Library allocation function?

const int alloctype = mSettings_->library.getAllocId(tok2, -1);

if (alloctype > 0) {

if (alloctype == mSettings_->library.deallocId("free"))

return Malloc;

if (alloctype == mSettings_->library.deallocId("fclose"))

return File;

return Library::ismemory(alloctype) ? OtherMem : OtherRes;

}

}

while (Token::Match(tok2,"%name% ::|. %type%"))

tok2 = tok2->tokAt(2);

// User function

const Function* func = tok2->function();

if (func == nullptr)

return No;

// Prevent recursion

if (callstack && std::find(callstack->begin(), callstack->end(), func) != callstack->end())

return No;

std::list<const Function*> cs;

if (!callstack)

callstack = &cs;

callstack->push_back(func);

return functionReturnType(func, callstack);

{

// What we may have...

// * var = (char *)realloc(..;

if (tok2 && tok2->str() == "(") {

tok2 = tok2->link();

tok2 = tok2 ? tok2->next() : nullptr;

}

if (! tok2)

return No;

if (!Token::Match(tok2, "%name% ("))

return No;

const Library::AllocFunc *f = mSettings_->library.getReallocFuncInfo(tok2);

if (!(f && f->reallocArg > 0 && f->reallocArg <= numberOfArguments(tok2)))

return No;

const Token* arg = getArguments(tok2).at(f->reallocArg - 1);

while (arg && arg->isCast())

arg = arg->astOperand1();

while (arg && arg->isUnaryOp("*"))

arg = arg->astOperand1();

if (varid > 0 && !Token::Match(arg, "%varid% [,)]", varid))

return No;

const int realloctype = mSettings_->library.getReallocId(tok2, -1);

if (realloctype > 0) {

if (realloctype == mSettings_->library.deallocId("free"))

return Malloc;

if (realloctype == mSettings_->library.deallocId("fclose"))

return File;

return Library::ismemory(realloctype) ? OtherMem : OtherRes;

}

return No;

{

if (mTokenizer_->isCPP() && tok->str() == "delete" && tok->astOperand1()) {

const Token* vartok = tok->astOperand1();

if (Token::Match(vartok, ".|::"))

vartok = vartok->astOperand2();

if (vartok && vartok->varId() == varid) {

if (tok->strAt(1) == "[")

return NewArray;

return New;

}

}

if (tok->str() == "::")

tok = tok->next();

if (Token::Match(tok, "%name% (")) {

if (Token::simpleMatch(tok, "fcloseall ( )"))

return File;

int argNr = 1;

for (const Token* tok2 = tok->tokAt(2); tok2; tok2 = tok2->nextArgument()) {

const Token* vartok = tok2;

while (Token::Match(vartok, "%name% .|::"))

vartok = vartok->tokAt(2);

if (Token::Match(vartok, "%varid% )|,|-", varid)) {

if (tok->str() == "realloc" && Token::simpleMatch(vartok->next(), ", 0 )"))

return Malloc;

if (mSettings_->posix()) {

if (tok->str() == "close")

return Fd;

if (tok->str() == "pclose")

return Pipe;

}

// Does tok point on a Library deallocation function?

const int dealloctype = mSettings_->library.getDeallocId(tok, argNr);

if (dealloctype > 0) {

if (dealloctype == mSettings_->library.deallocId("free"))

return Malloc;

if (dealloctype == mSettings_->library.deallocId("fclose"))

return File;

return Library::ismemory(dealloctype) ? OtherMem : OtherRes;

}

}

argNr++;

}

}

return No;

{

if (getReallocationType(tok, 0) == File) {

const Library::AllocFunc *f = mSettings_->library.getReallocFuncInfo(tok);

if (f && f->reallocArg > 0 && f->reallocArg <= numberOfArguments(tok)) {

const Token* arg = getArguments(tok).at(f->reallocArg - 1);

if (Token::Match(arg, "stdin|stdout|stderr"))

return true;

}

}

return false;

{

if (alloctype == CheckMemoryLeak::File ||

alloctype == CheckMemoryLeak::Pipe ||

alloctype == CheckMemoryLeak::Fd ||

alloctype == CheckMemoryLeak::OtherRes)

resourceLeakError(tok, varname);

else

memleakError(tok, varname);

{

std::list<const Token *> callstack;

if (tok)

callstack.push_back(tok);

reportErr(callstack, severity, id, msg, cwe);

{

const ErrorMessage errmsg(callstack, mTokenizer_ ? &mTokenizer_->list : nullptr, severity, id, msg, cwe, false);

if (mErrorLogger_)

mErrorLogger_->reportErr(errmsg);

else

Check::reportError(errmsg);

{

std::string errmsg("Resource leak");

if (!varname.empty())

errmsg = "$symbol:" + varname + '\n' + errmsg + ": $symbol";

reportErr(tok, Severity::error, "resourceLeak", errmsg, CWE(775U));

{

if (!func || !func->hasBody() || !func->functionScope)

return No;

// Get return pointer..

int varid = 0;

for (const Token *tok2 = func->functionScope->bodyStart; tok2 != func->functionScope->bodyEnd; tok2 = tok2->next()) {

if (const Token *endOfLambda = findLambdaEndToken(tok2))

tok2 = endOfLambda;

if (tok2->str() == "{" && !tok2->scope()->isExecutable())

tok2 = tok2->link();

if (tok2->str() == "return") {

const AllocType allocType = getAllocationType(tok2->next(), 0, callstack);

if (allocType != No)

return allocType;

if (tok2->scope() != func->functionScope || !tok2->astOperand1())

return No;

const Token* tok = tok2->astOperand1();

if (Token::Match(tok, ".|::"))

tok = tok->astOperand2() ? tok->astOperand2() : tok->astOperand1();

if (tok)

varid = tok->varId();

break;

}

}

// Not returning pointer value..

if (varid == 0)

return No;

// If variable is not local then alloctype shall be "No"

// Todo: there can be false negatives about mismatching allocation/deallocation.

// => Generate "alloc ; use ;" if variable is not local?

const Variable *var = mTokenizer_->getSymbolDatabase()->getVariableFromVarId(varid);

if (!var || !var->isLocal() || var->isStatic())

return No;

// Check if return pointer is allocated..

AllocType allocType = No;

for (const Token* tok = func->functionScope->bodyStart; tok != func->functionScope->bodyEnd; tok = tok->next()) {

if (Token::Match(tok, "%varid% =", varid)) {

allocType = getAllocationType(tok->tokAt(2), varid, callstack);

}

if (Token::Match(tok, "= %varid% ;", varid)) {

return No;

}

if (!mTokenizer_->isC() && Token::Match(tok, "[(,] %varid% [,)]", varid)) {

return No;

}

if (Token::Match(tok, "[(,] & %varid% [.,)]", varid)) {

return No;

}

if (Token::Match(tok, "[;{}] %varid% .", varid)) {

return No;

}

if (allocType == No && tok->str() == "return")

return No;

}

return allocType;

{

if (!tok)

return false;

if (Token::Match(tok, "&&|;"))

return notvar(tok->astOperand1(),varid) || notvar(tok->astOperand2(),varid);

if (tok->str() == "(" && Token::Match(tok->astOperand1(), "UNLIKELY|LIKELY"))

return notvar(tok->astOperand2(), varid);

const Token *vartok = astIsVariableComparison(tok, "==", "0");

return vartok && (vartok->varId() == varid);

{

if (!Token::simpleMatch(tok, "if ("))

return false;

const Token *condition = tok->next()->astOperand2();

if (condition && condition->str() == "(" && Token::Match(condition->astOperand1(), "UNLIKELY|LIKELY"))

condition = condition->astOperand2();

if (!condition || condition->str() == "&&")

return false;

const Token *vartok = astIsVariableComparison(condition, comp, rhs);

return (vartok && vartok->varId() == varid);

{

const Variable* var = symbolDatabase->getVariableFromVarId(varid);

return var && !var->isArgument();

{

// only check functions

const SymbolDatabase *symbolDatabase = mTokenizer->getSymbolDatabase();

for (const Scope * scope : symbolDatabase->functionScopes) {

// Search for the "var = realloc(var, 100" pattern within this function

for (const Token *tok = scope->bodyStart->next(); tok != scope->bodyEnd; tok = tok->next()) {

if (tok->varId() > 0 && Token::Match(tok, "%name% =")) {

// Get the parenthesis in "realloc("

const Token* parTok = tok->next()->astOperand2();

// Skip casts

while (parTok && parTok->isCast())

parTok = parTok->astOperand1();

if (!parTok)

continue;

const Token *const reallocTok = parTok->astOperand1();

if (!reallocTok)

continue;

const Library::AllocFunc* f = mSettings->library.getReallocFuncInfo(reallocTok);

if (!(f && f->arg == -1 && mSettings->library.isnotnoreturn(reallocTok)))

continue;

const AllocType allocType = getReallocationType(reallocTok, tok->varId());

if (!((allocType == Malloc || allocType == OtherMem)))

continue;

const Token* arg = getArguments(reallocTok).at(f->reallocArg - 1);

while (arg && arg->isCast())

arg = arg->astOperand1();

const Token* tok2 = tok;

while (arg && arg->isUnaryOp("*") && tok2 && tok2->astParent() && tok2->astParent()->isUnaryOp("*")) {

arg = arg->astOperand1();

tok2 = tok2->astParent();

}

if (!arg || !tok2)

continue;

if (!((tok->varId() == arg->varId()) && isNoArgument(symbolDatabase, tok->varId())))

continue;

// Check that another copy of the pointer wasn't saved earlier in the function

if (Token::findmatch(scope->bodyStart, "%name% = %varid% ;", tok, tok->varId()) ||

Token::findmatch(scope->bodyStart, "[{};] %varid% = *| %var% .| %var%| [;=]", tok, tok->varId()))

continue;

// Check if the argument is known to be null, which means it is not a memory leak

if (arg->hasKnownIntValue() && arg->getKnownIntValue() == 0) {

continue;

}

const Token* tokEndRealloc = reallocTok->linkAt(1);

// Check that the allocation isn't followed immediately by an 'if (!var) { error(); }' that might handle failure

if (Token::simpleMatch(tokEndRealloc->next(), "; if (") &&

notvar(tokEndRealloc->tokAt(3)->astOperand2(), tok->varId())) {

const Token* tokEndBrace = tokEndRealloc->linkAt(3)->linkAt(1);

if (tokEndBrace && mTokenizer->isScopeNoReturn(tokEndBrace))

continue;

}

memleakUponReallocFailureError(tok, reallocTok->str(), tok->str());

}

}

}

{

const SymbolDatabase *symbolDatabase = mTokenizer->getSymbolDatabase();

// only check classes and structures

for (const Scope * scope : symbolDatabase->classAndStructScopes) {

for (const Variable &var : scope->varlist) {

if (!var.isStatic() && var.isPointer()) {

// allocation but no deallocation of private variables in public function..

const Token *tok = var.typeStartToken();

// Either it is of standard type or a non-derived type

if (tok->isStandardType() || (var.type() && var.type()->derivedFrom.empty())) {

if (var.isPrivate())

checkPublicFunctions(scope, var.nameToken());

variable(scope, var.nameToken());

}

}

}

}

{

const std::string& varname = tokVarname->str();

const int varid = tokVarname->varId();

const std::string& classname = scope->className;

// Check if member variable has been allocated and deallocated..

CheckMemoryLeak::AllocType memberAlloc = CheckMemoryLeak::No;

CheckMemoryLeak::AllocType memberDealloc = CheckMemoryLeak::No;

bool allocInConstructor = false;

bool deallocInDestructor = false;

// Inspect member functions

for (const Function &func : scope->functionList) {

const bool constructor = func.isConstructor();

const bool destructor = func.isDestructor();

if (!func.hasBody()) {

if (destructor) { // implementation for destructor is not seen => assume it deallocates all variables properly

deallocInDestructor = true;

memberDealloc = CheckMemoryLeak::Many;

}

continue;

}

bool body = false;

const Token *end = func.functionScope->bodyEnd;

for (const Token *tok = func.arg->link(); tok != end; tok = tok->next()) {

if (tok == func.functionScope->bodyStart)

body = true;

else {

if (!body) {

if (!Token::Match(tok, ":|, %varid% (", varid))

continue;

}

// Allocate..

if (!body || Token::Match(tok, "%varid% =", varid)) {

// var1 = var2 = ...

// bail out

if (tok->strAt(-1) == "=")

return;

// Foo::var1 = ..

// bail out when not same class

if (tok->strAt(-1) == "::" &&

tok->strAt(-2) != scope->className)

return;

AllocType alloc = getAllocationType(tok->tokAt(body ? 2 : 3), 0);

if (alloc != CheckMemoryLeak::No) {

if (constructor)

allocInConstructor = true;

if (memberAlloc != No && memberAlloc != alloc)

alloc = CheckMemoryLeak::Many;

if (alloc != CheckMemoryLeak::Many && memberDealloc != CheckMemoryLeak::No && memberDealloc != CheckMemoryLeak::Many && memberDealloc != alloc) {

std::list<const Token *> callstack;

callstack.push_back(tok);

mismatchAllocDealloc(callstack, classname + "::" + varname);

}

memberAlloc = alloc;

}

}

if (!body)

continue;

// Deallocate..

AllocType dealloc = getDeallocationType(tok, varid);

// some usage in the destructor => assume it's related

// to deallocation

if (destructor && tok->str() == varname)

dealloc = CheckMemoryLeak::Many;

if (dealloc != CheckMemoryLeak::No) {

if (destructor)

deallocInDestructor = true;

// several types of allocation/deallocation?

if (memberDealloc != CheckMemoryLeak::No && memberDealloc != dealloc)

dealloc = CheckMemoryLeak::Many;

if (dealloc != CheckMemoryLeak::Many && memberAlloc != CheckMemoryLeak::No && memberAlloc != Many && memberAlloc != dealloc) {

std::list<const Token *> callstack;

callstack.push_back(tok);

mismatchAllocDealloc(callstack, classname + "::" + varname);

}

memberDealloc = dealloc;

}

// Function call .. possible deallocation

else if (Token::Match(tok->previous(), "[{};] %name% (")) {

if (!CheckMemoryLeakInFunction::test_white_list(tok->str(), mSettings, mTokenizer->isCPP())) {

return;

}

}

}

}

}

if (allocInConstructor && !deallocInDestructor) {

unsafeClassError(tokVarname, classname, classname + "::" + varname /*, memberAlloc*/);

} else if (memberAlloc != CheckMemoryLeak::No && memberDealloc == CheckMemoryLeak::No) {

unsafeClassError(tokVarname, classname, classname + "::" + varname /*, memberAlloc*/);

}

{

if (!mSettings->isEnabled(Settings::STYLE))

return;

reportError(tok, Severity::style, "unsafeClassCanLeak",

"$symbol:" + classname + "\n"

"$symbol:" + varname + "\n"

"Class '" + classname + "' is unsafe, '" + varname + "' can leak by wrong usage.\n"

"The class '" + classname + "' is unsafe, wrong usage can cause memory/resource leaks for '" + varname + "'. This can for instance be fixed by adding proper cleanup in the destructor.", CWE398, false);

{

// Check that public functions deallocate the pointers that they allocate.

// There is no checking how these functions are used and therefore it

// isn't established if there is real leaks or not.

if (!mSettings->isEnabled(Settings::WARNING))

return;

const int varid = classtok->varId();

// Parse public functions..

// If they allocate member variables, they should also deallocate

for (const Function &func : scope->functionList) {

if ((func.type == Function::eFunction || func.type == Function::eOperatorEqual) &&

func.access == AccessControl::Public && func.hasBody()) {

const Token *tok2 = func.functionScope->bodyStart->next();

if (Token::Match(tok2, "%varid% =", varid)) {

const CheckMemoryLeak::AllocType alloc = getAllocationType(tok2->tokAt(2), varid);

if (alloc != CheckMemoryLeak::No)

publicAllocationError(tok2, tok2->str());

} else if (Token::Match(tok2, "%type% :: %varid% =", varid) &&

tok2->str() == scope->className) {

const CheckMemoryLeak::AllocType alloc = getAllocationType(tok2->tokAt(4), varid);

if (alloc != CheckMemoryLeak::No)

publicAllocationError(tok2, tok2->strAt(2));

}

}

}

{

if (mSettings->clang)

return;

const SymbolDatabase* symbolDatabase = mTokenizer->getSymbolDatabase();

for (const Variable* var : symbolDatabase->variableList()) {

if (!var || !var->isLocal() || var->isStatic() || var->isReference())

continue;

if (var->typeEndToken()->isStandardType())

continue;

if (var->scope()->hasInlineOrLambdaFunction())

continue;

checkStructVariable(var);

}

{

const int declarationId(variable->declarationId());

bool alloc = false;

for (const Token *tok2 = variable->nameToken(); tok2 && tok2 != variable->scope()->bodyEnd; tok2 = tok2->next()) {

if (Token::Match(tok2, "= %varid% [;=]", declarationId)) {

return false;

} else if (Token::Match(tok2, "%varid% = malloc|kmalloc (", declarationId)) {

alloc = true;

}

}

return alloc;

{

// Is struct variable a pointer?

if (variable->isPointer()) {

// Check that variable is allocated with malloc

if (!isMalloc(variable))

return;

} else if (!mTokenizer->isC() && (!variable->typeScope() || variable->typeScope()->getDestructor())) {

// For non-C code a destructor might cleanup members

return;

}

// Check struct..

int indentlevel2 = 0;

for (const Token *tok2 = variable->nameToken(); tok2 && tok2 != variable->scope()->bodyEnd; tok2 = tok2->next()) {

if (tok2->str() == "{")

++indentlevel2;

else if (tok2->str() == "}") {

if (indentlevel2 == 0)

break;

--indentlevel2;

}

// Unknown usage of struct

/** @todo Check how the struct is used. Only bail out if necessary */

else if (Token::Match(tok2, "[(,] %varid% [,)]", variable->declarationId()))

break;

// Struct member is allocated => check if it is also properly deallocated..

else if (Token::Match(tok2->previous(), "[;{}] %varid% . %var% =", variable->declarationId())) {

if (getAllocationType(tok2->tokAt(4), tok2->tokAt(2)->varId()) == AllocType::No)

continue;

const int structid(variable->declarationId());

const int structmemberid(tok2->tokAt(2)->varId());

// This struct member is allocated.. check that it is deallocated

int indentlevel3 = indentlevel2;

for (const Token *tok3 = tok2; tok3; tok3 = tok3->next()) {

if (tok3->str() == "{")

++indentlevel3;

else if (tok3->str() == "}") {

if (indentlevel3 == 0) {

memoryLeak(tok3, variable->name() + "." + tok2->strAt(2), Malloc);

break;

}

--indentlevel3;

}

// Deallocating the struct member..

else if (getDeallocationType(tok3, structmemberid) != AllocType::No) {

// If the deallocation happens at the base level, don't check this member anymore

if (indentlevel3 == 0)

break;

// deallocating and then returning from function in a conditional block =>

// skip ahead out of the block

bool ret = false;

while (tok3) {

if (tok3->str() == "return")

ret = true;

else if (tok3->str() == "{" || tok3->str() == "}")

break;

tok3 = tok3->next();

}

if (!ret || !tok3 || tok3->str() != "}")

break;

--indentlevel3;

continue;

}

// Deallocating the struct..

else if (Token::Match(tok3, "free|kfree ( %varid% )", structid)) {

if (indentlevel2 == 0)

memoryLeak(tok3, variable->name() + "." + tok2->strAt(2), Malloc);

break;

}

// failed allocation => skip code..

else if (Token::simpleMatch(tok3, "if (") &&

notvar(tok3->next()->astOperand2(), structmemberid)) {

// Goto the ")"

tok3 = tok3->next()->link();

// make sure we have ") {".. it should be

if (!Token::simpleMatch(tok3, ") {"))

break;

// Goto the "}"

tok3 = tok3->next()->link();

}

// succeeded allocation

else if (ifvar(tok3, structmemberid, "!=", "0")) {

// goto the ")"

tok3 = tok3->next()->link();

// check if the variable is deallocated or returned..

int indentlevel4 = 0;

for (const Token *tok4 = tok3; tok4; tok4 = tok4->next()) {

if (tok4->str() == "{")

++indentlevel4;

else if (tok4->str() == "}") {

--indentlevel4;

if (indentlevel4 == 0)

break;

} else if (Token::Match(tok4, "free|kfree ( %var% . %varid% )", structmemberid)) {

break;

}

}

// was there a proper deallocation?

if (indentlevel4 > 0)

break;

}

// Returning from function..

else if (tok3->str() == "return") {

// Returning from function without deallocating struct member?

if (!Token::Match(tok3, "return %varid% ;", structid) &&

!Token::Match(tok3, "return & %varid%", structid) &&

!(Token::Match(tok3, "return %varid% . %var%", structid) && tok3->tokAt(3)->varId() == structmemberid)) {

memoryLeak(tok3, variable->name() + "." + tok2->strAt(2), Malloc);

}

break;

}

// struct assignment..

else if (Token::Match(tok3, "= %varid% ;", structid)) {

break;

} else if (Token::Match(tok3, "= %var% . %varid% ;", structmemberid)) {

break;

}

// goto isn't handled well.. bail out even though there might be leaks

else if (tok3->str() == "goto")

break;

// using struct in a function call..

else if (Token::Match(tok3, "%name% (")) {

// Calling non-function / function that doesn't deallocate?

if (CheckMemoryLeakInFunction::test_white_list(tok3->str(), mSettings, mTokenizer->isCPP()))

continue;

// Check if the struct is used..

bool deallocated = false;

const Token* const end4 = tok3->linkAt(1);

for (const Token *tok4 = tok3; tok4 != end4; tok4 = tok4->next()) {

if (Token::Match(tok4, "[(,] &| %varid% [,)]", structid)) {

/** @todo check if the function deallocates the memory */

deallocated = true;

break;

}

if (Token::Match(tok4, "[(,] &| %varid% . %name% [,)]", structid)) {

/** @todo check if the function deallocates the memory */

deallocated = true;

break;

}

}

if (deallocated)

break;

}

}

}

}

{

const SymbolDatabase *symbolDatabase = mTokenizer->getSymbolDatabase();

// only check functions

for (const Scope * scope : symbolDatabase->functionScopes) {

// Checks if a call to an allocation function like malloc() is made and its return value is not assigned.

checkForUnusedReturnValue(scope);

// Checks to see if a function is called with memory allocated for an argument that

// could be leaked if a function called for another argument throws.

checkForUnsafeArgAlloc(scope);

// Check for leaks where a the return value of an allocation function like malloc() is an input argument,

// for example f(malloc(1)), where f is known to not release the input argument.

checkForUnreleasedInputArgument(scope);

}

{

// parse the executable scope until tok is reached...

for (const Token *tok = scope->bodyStart; tok != scope->bodyEnd; tok = tok->next()) {

// allocating memory in parameter for function call..

if (!Token::Match(tok, "%name% ("))

continue;

// check if the output of the function is assigned

const Token* tok2 = tok->next()->astParent();

while (tok2 && tok2->isCast())

tok2 = tok2->astParent();