From 706631f527e98cacf36ddce09de2a608e64f23a3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20Marjam=C3=A4ki?= <danielm77@spray.se>
Date: Sun, 22 Apr 2012 12:22:49 +0200
Subject: [PATCH] Fixed #3748 (False positive out of bounds with postincrement)

---
 lib/tokenize.cpp      |  7 +++++--
 test/testtokenize.cpp | 19 +++++++++++++++++--
 2 files changed, 22 insertions(+), 4 deletions(-)

diff --git a/lib/tokenize.cpp b/lib/tokenize.cpp
index 935d91128..2a3f00650 100644
--- a/lib/tokenize.cpp
+++ b/lib/tokenize.cpp
@@ -6053,7 +6053,7 @@ bool Tokenizer::simplifyKnownVariables()
                 const bool valueIsPointer = false;
 
                 Token *scopeStart = tok2->tokAt(6);
-                ret |= simplifyKnownVariablesSimplify(&scopeStart, scopeStart, varid, structname, value, valueIsPointer, valueVarId, valueToken, 0);
+                ret |= simplifyKnownVariablesSimplify(&scopeStart, scopeStart, varid, structname, value, valueIsPointer, valueVarId, valueToken, -1);
             }
 
             else if (Token::Match(tok2, "strcpy ( %var% , %str% ) ;")) {
@@ -6147,6 +6147,9 @@ bool Tokenizer::simplifyKnownVariablesSimplify(Token **tok2, Token *tok3, unsign
 
     bool ret = false;
 
+    // skip increments and decrements if the given indentlevel is -1
+    const bool skipincdec = (indentlevel == -1);
+
     Token* bailOutFromLoop = 0;
     int indentlevel3 = indentlevel;
     bool ret3 = false;
@@ -6473,7 +6476,7 @@ bool Tokenizer::simplifyKnownVariablesSimplify(Token **tok2, Token *tok3, unsign
             }
         }
 
-        if (indentlevel == indentlevel3 && Token::Match(tok3->next(), "%varid% ++|--", varid) && MathLib::isInt(value)) {
+        if (!skipincdec && indentlevel == indentlevel3 && Token::Match(tok3->next(), "%varid% ++|--", varid) && MathLib::isInt(value)) {
             const std::string op(tok3->strAt(2));
             if (Token::Match(tok3, "[{};] %any% %any% ;")) {
                 tok3->deleteNext(3);
diff --git a/test/testtokenize.cpp b/test/testtokenize.cpp
index 0d8718545..ba73ebb13 100644
--- a/test/testtokenize.cpp
+++ b/test/testtokenize.cpp
@@ -150,7 +150,8 @@ private:
         TEST_CASE(simplifyKnownVariables45);    // ticket #3281 - static constant variable not simplified
         TEST_CASE(simplifyKnownVariables46);    // ticket #3587 - >>
         TEST_CASE(simplifyKnownVariables47);    // ticket #3627 - >>
-        TEST_CASE(simplifyKnownVariablesIfEq);  // if (a==5) => a is 5 in the block
+        TEST_CASE(simplifyKnownVariablesIfEq1); // if (a==5) => a is 5 in the block
+        TEST_CASE(simplifyKnownVariablesIfEq2); // if (a==5) { buf[a++] = 0; }
         TEST_CASE(simplifyKnownVariablesBailOutAssign1);
         TEST_CASE(simplifyKnownVariablesBailOutAssign2);
         TEST_CASE(simplifyKnownVariablesBailOutFor1);
@@ -2277,7 +2278,7 @@ private:
         ASSERT_EQUALS(expected, tokenizeAndStringify(code, true, true, Settings::Unspecified, "test.cpp"));
     }
 
-    void simplifyKnownVariablesIfEq() {
+    void simplifyKnownVariablesIfEq1() {
         const char code[] = "void f(int x) {\n"
                             "    if (x==5) {\n"
                             "        return x;\n"
@@ -2291,6 +2292,20 @@ private:
         ASSERT_EQUALS(expected, tokenizeAndStringify(code, true, true, Settings::Unspecified, "test.c"));
     }
 
+    void simplifyKnownVariablesIfEq2() {
+        const char code[] = "void f(int x) {\n"
+                            "    if (x==5) {\n"
+                            "        buf[x++] = 0;\n"
+                            "    }\n"
+                            "}";
+        const char expected[] = "void f ( int x ) {\n"
+                                "if ( x == 5 ) {\n"
+                                "buf [ x ++ ] = 0 ;\n"
+                                "}\n"
+                                "}";
+        ASSERT_EQUALS(expected, tokenizeAndStringify(code, true, true, Settings::Unspecified, "test.c"));
+    }
+
     void simplifyKnownVariablesBailOutAssign1() {
         const char code[] = "int foo() {\n"
                             "    int i; i = 0;\n"