Fix

Author: web-flow

lib/valueflow.cpp

@@ -1473,6 +1473,19 @@ ValueFlow::Value ValueFlow::getLifetimeObjValue(const Token *tok, bool inconclus
     return std::move(values.front());
 }
 
+static bool checkDotLifetime(const Token* dot, const Token* tok)
+{
+    if (Token::simpleMatch(dot->astOperand1(), "."))
+        return false;
+    if (!dot->astOperand2())
+        return true;
+    if (dot->astOperand2()->varId() && tok->isUnaryOp("*"))
+        return dot->astOperand2()->variable() && dot->astOperand2()->variable()->isArray();
+    if (dot->astOperand2()->valueType() && dot->astOperand2()->valueType()->reference != Reference::None)
+        return false;
+    return true;
+}
+
 template<class Predicate>
 static std::vector<ValueFlow::LifetimeToken> getLifetimeTokens(const Token* tok,
                                                                bool escape,
@@ -1585,8 +1598,7 @@ static std::vector<ValueFlow::LifetimeToken> getLifetimeTokens(const Token* tok,
             if (vartok->str() == "[" || vartok->isUnaryOp("*"))
                 vartok = vartok->astOperand1();
             else if (vartok->str() == ".") {
-                if (!Token::simpleMatch(vartok->astOperand1(), ".") &&
-                    !(vartok->astOperand2() && ((vartok->astOperand2()->varId() && tok->isUnaryOp("*")) || (vartok->astOperand2()->valueType() && vartok->astOperand2()->valueType()->reference != Reference::None))))
+                if (checkDotLifetime(vartok, tok))
                     vartok = vartok->astOperand1();
                 else
                     break;

test/testautovariables.cpp

@@ -4587,6 +4587,17 @@ class TestAutoVariables : public TestFixture {
               "    return &*x.a;\n"
               "}\n");
         ASSERT_EQUALS("", errout_str());
+
+        check("struct S { int a[1]; };\n"
+              "int& f(S s) {\n"
+              "    return *s.a;\n"
+              "}\n"
+              "int* g(S s) {\n"
+              "    return &*s.a;\n"
+              "}\n");
+        ASSERT_EQUALS("[test.cpp:3:12]: (error) Reference to local variable returned. [returnReference]\n"
+                      "[test.cpp:6:12] -> [test.cpp:5:10] -> [test.cpp:6:12]: (error) Returning pointer to local variable 's' that will be invalid when returning. [returnDanglingLifetime]\n",
+                      errout_str());
     }
 
     void danglingLifetimeClassMemberFunctions()