Skip to content

Fix #14990: FP memleak with function call through function pointer #8813

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
aadanen wants to merge 10 commits into
base: main
Choose a base branch
from
Open

Fix #14990: FP memleak with function call through function pointer #8813

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
6cd44e8
impl and tests
aadanen Aug 28, 2026
64b20cd
formatting
aadanen Aug 27, 2026
dd3c8fd
formatting
aadanen Aug 27, 2026
c1593be
sanitizer
aadanen Aug 27, 2026
effada4
make functionCall not segfault
aadanen Aug 27, 2026
1f99cf0
(int) is not lambda call
aadanen Aug 28, 2026
72a9b13
fixed infinite loops on certain inputs
aadanen Aug 31, 2026
4f3a25d
fixed redundantNextPrevious
aadanen Aug 31, 2026
6e5b86b
clarified checks and fixed test
aadanen Sep 8, 2026
1970878
format
aadanen Sep 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
111 changes: 88 additions & 23 deletions lib/checkleakautovar.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -267,6 +267,46 @@ static const Token * isFunctionCall(const Token * nameToken)
return nullptr;
}

/** checks if tok is part of the LHS of an anonymous function call:
* tok should be the first token in a unary expression that evaluates to a
* function pointer, or the name of a lambda or function
* (*func_ptr)(arg)
* or
* (lambda)(arg)
* or
* get_function()(arg)
*
* @param tok on the LHS of a function call
* @return opening parenthesis token or nullptr if not a function call
*/
static const Token *isAnonymousFunctionCall(const Token *tok)
{
if (!tok || tok->isStandardType())
return nullptr;

auto isLparNotCast = [](const Token *lpar) -> bool {
return !lpar->isCast() && lpar->str() == "(";
};

// function pointer or lambda
if (isLparNotCast(tok->previous())) {
tok = tok->linkAt(-1)->next();
} else if (tok->isName() && isLparNotCast(tok->next())) {
// call to result of a function
tok = tok->linkAt(1)->next();
} else {
return nullptr;
}

// < could be a less than, not a template operator
if (tok->link() && tok->str() == "<")
tok = tok->link()->next();

if (isLparNotCast(tok))
return tok;
return nullptr;
}

static const Token* getOutparamAllocation(const Token* tok, const Library& library)
{
if (!tok)
Expand Down Expand Up @@ -787,9 +827,22 @@ bool CheckLeakAutoVarImpl::checkScope(const Token * const startToken,
}
}

// a regular function call can return an anonymous function
openingPar = isAnonymousFunctionCall(ftok);
if (openingPar) {
functionCall(nullptr, openingPar, varInfo, VarInfo::AllocInfo(0, VarInfo::NOALLOC), nullptr);
tok = openingPar->link();
}

continue;

}
// top level call to an anonymous function

@danmar danmar Oct 2, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is an AI review take it with a grain of salt. Please feel free to reject it by clicking on Resolve button

I built this branch and its merge-base, and found a new false positive when the argument of the anonymous call deallocates the resource:

#include <stdio.h>
void a(void (*report)(int), const char *name) {
    FILE *f = fopen(name, "r");
    if (!f) return;
    (*report)(fclose(f));
}
typedef void (*fn_t)(int);
fn_t get_fn(void);
void b(const char *name) {
    FILE *f = fopen(name, "r");
    if (!f) return;
    get_fn()(fclose(f));
}
6: error deallocuse Dereferencing 'f' after it is deallocated / released
13: error deallocuse Dereferencing 'f' after it is deallocated / released

The merge-base gives no warning for either function. It looks like the argument tokens are processed twice: once as the normal fclose(f) call, and then again by functionCall(nullptr, lpar, ...), which sees f after the dealloc. Could you add these as test cases?

The other shapes I tried gave no new warnings: (*cb)(p); free(p);, (cb)(NULL); free(p);, if ((*cb)(1)) { free(p); return; }, (free)(p);, (*cb)(1) + (free(p), 0), (*cb)(1), fclose(f);.

@aadanen aadanen Oct 5, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

My change didn't introduce a new false positive, but brought the behavior of function pointer calls into line with the current behavior of normal function calls.

void b(const char *name) {
    FILE *f = fopen(name, "r");
    if (!f) return;
    foo(fclose(f));
}

the code above throws the false positive deallocuse on main.

This seems to me like it should be a separate pull request and bug report because it isn't really part of fixing the #14990 FP memleak. I understand if that fix needs to land first before we merge this one, but I don't currently have the cycles to look into it.

else if (const Token *lpar = isAnonymousFunctionCall(tok)) {
functionCall(nullptr, lpar, varInfo, VarInfo::AllocInfo(0, VarInfo::NOALLOC), nullptr);
tok = lpar->link();

}
// goto => weird execution path
else if (tok->str() == "goto") {
varInfo.clear();
Expand Down Expand Up @@ -941,6 +994,7 @@ const Token * CheckLeakAutoVarImpl::checkTokenInsideExpression(const Token * con

// check for function call
const Token * const openingPar = inFuncCall ? nullptr : isFunctionCall(tok);
const Token * const anonOpeningPar = isAnonymousFunctionCall(tok);
if (openingPar) {
const Library::AllocFunc* allocFunc = mSettings.library.getDeallocFuncInfo(tok);
VarInfo::AllocInfo alloc(allocFunc ? allocFunc->groupId : 0, VarInfo::DEALLOC, tok);
Expand All @@ -951,7 +1005,15 @@ const Token * CheckLeakAutoVarImpl::checkTokenInsideExpression(const Token * con
if (startsWith(returnValue, "arg"))
// the function returns one of its argument, we need to process a potential assignment
return openingPar;
return isCPPCast(tok->astParent()) ? openingPar : openingPar->link();

if (!anonOpeningPar)
return isCPPCast(tok->astParent()) ? openingPar : openingPar->link();
}

// check for anonymous function call
if (anonOpeningPar) {
functionCall(nullptr, anonOpeningPar, varInfo, VarInfo::AllocInfo(0, VarInfo::NOALLOC), nullptr);
return anonOpeningPar->link();
}

return nullptr;
Expand Down Expand Up @@ -1018,11 +1080,10 @@ void CheckLeakAutoVarImpl::changeAllocStatus(VarInfo &varInfo, const VarInfo::Al

void CheckLeakAutoVarImpl::functionCall(const Token *tokName, const Token *tokOpeningPar, VarInfo &varInfo, const VarInfo::AllocInfo& allocation, const Library::AllocFunc* af)
{
// Ignore function call?
const bool isLeakIgnore = mSettings.library.isLeakIgnore(mSettings.library.getFunctionName(tokName));
if (mSettings.library.getReallocFuncInfo(tokName))
const bool isLeakIgnore = tokName ? mSettings.library.isLeakIgnore(mSettings.library.getFunctionName(tokName)) : false;
if (tokName && mSettings.library.getReallocFuncInfo(tokName))
return;
if (tokName->next()->valueType() && tokName->next()->valueType()->container && tokName->next()->valueType()->container->stdStringLike)
if (tokName && tokName->next()->valueType() && tokName->next()->valueType()->container && tokName->next()->valueType()->container->stdStringLike)
return;

const Token * const tokFirstArg = tokOpeningPar->next();
Expand Down Expand Up @@ -1071,26 +1132,30 @@ void CheckLeakAutoVarImpl::functionCall(const Token *tokName, const Token *tokOp

// Is variable allocated?
if (!isnull && (!af || af->arg == argNr)) {
const Library::AllocFunc* deallocFunc = mSettings.library.getDeallocFuncInfo(tokName);
const Library::AllocFunc* deallocFunc = tokName ? mSettings.library.getDeallocFuncInfo(tokName) : nullptr;
VarInfo::AllocInfo dealloc(deallocFunc ? deallocFunc->groupId : 0, VarInfo::DEALLOC, tokName);
if (const Library::AllocFunc* allocFunc = mSettings.library.getAllocFuncInfo(tokName)) {
if (mSettings.library.getDeallocFuncInfo(tokName)) {
changeAllocStatus(varInfo, dealloc.type == 0 ? allocation : dealloc, tokName, arg);
}
if (allocFunc->arg == argNr &&
!(arg->variable() && arg->variable()->isArgument() && arg->valueType() && arg->valueType()->pointer > 1) &&
(isAddressOf || (arg->valueType() && arg->valueType()->pointer == 2))) {
leakIfAllocated(arg, varInfo);
VarInfo::AllocInfo& varAlloc = varInfo.alloctype[arg->varId()];
varAlloc.type = allocFunc->groupId;
varAlloc.status = VarInfo::ALLOC;
varAlloc.allocTok = arg;
if (tokName) {
if (const Library::AllocFunc* allocFunc = mSettings.library.getAllocFuncInfo(tokName)) {
if (mSettings.library.getDeallocFuncInfo(tokName)) {
changeAllocStatus(varInfo, dealloc.type == 0 ? allocation : dealloc, tokName, arg);
}
if (allocFunc->arg == argNr &&
!(arg->variable() && arg->variable()->isArgument() && arg->valueType() && arg->valueType()->pointer > 1) &&
(isAddressOf || (arg->valueType() && arg->valueType()->pointer == 2))) {
leakIfAllocated(arg, varInfo);
VarInfo::AllocInfo& varAlloc = varInfo.alloctype[arg->varId()];
varAlloc.type = allocFunc->groupId;
varAlloc.status = VarInfo::ALLOC;
varAlloc.allocTok = arg;
}
}
else if (isLeakIgnore)
checkTokenInsideExpression(arg, varInfo);
else
changeAllocStatus(varInfo, dealloc.type == 0 ? allocation : dealloc, tokName, arg);
} else {
changeAllocStatus(varInfo, allocation, nullptr, arg);
}
else if (isLeakIgnore)
checkTokenInsideExpression(arg, varInfo);
else
changeAllocStatus(varInfo, dealloc.type == 0 ? allocation : dealloc, tokName, arg);
}
}
// Check smart pointer
Expand Down Expand Up @@ -1269,7 +1334,7 @@ void CheckLeakAutoVarImpl::ret(const Token *tok, VarInfo &varInfo, const bool is
const auto use = possibleUsage.find(varid);
if (use == possibleUsage.end()) {
leakError(tok, var->name(), it->second.type);
} else if (!use->second.first->variable()) { // TODO: handle constructors
} else if (use->second.first && !use->second.first->variable()) { // TODO: handle constructors
configurationInfo(tok, use->second);
}
}
Expand Down
49 changes: 49 additions & 0 deletions test/testleakautovar.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -118,6 +118,7 @@ class TestLeakAutoVar : public TestFixture {

// handling function calls
TEST_CASE(functioncall1);
TEST_CASE(anonymousFunctionCall1);

// goto
TEST_CASE(goto1);
Expand Down Expand Up @@ -1910,6 +1911,54 @@ class TestLeakAutoVar : public TestFixture {
ASSERT_EQUALS("[test.cpp:4:1]: (error) Memory leak: b [memleak]\n", errout_str());
}

void anonymousFunctionCall1() { // #14990
// function pointer
check("void f(void (*fptr)(void *)) {\n"
"void *buf = malloc(1);\n"
"(*fptr)(buf);\n"
"}\n");
ASSERT_EQUALS("", errout_str());

// lambda
check("void f() {\n"
"auto x = [](void *ptr) { g(ptr) };\n"
"void *p = malloc(1);\n"
"(x)(p);\n"
"}\n", dinit(CheckOptions, $.cpp = true));
ASSERT_EQUALS("", errout_str());

// Function returning a function pointer
check("void f() {\n"
" void *buf = malloc(1);\n"
" get_function()(buf);\n"
"}\n");
ASSERT_EQUALS("", errout_str());

// Function returning a function pointer, passed as an arg to a normal
// function
check("void f() {\n"
" void *buf = malloc(1);\n"
" foo(get_function()(buf));\n"
"}\n");
ASSERT_EQUALS("[test.c:3:29]: (information) --check-library: Function foo() should have <noreturn> configuration [checkLibraryNoReturn]\n"
"[test.c:4:1]: (information) --check-library: Function foo() should have <use>/<leak-ignore> configuration [checkLibraryUseIgnore]\n",
errout_str());

// Function returning a function pointer, passed as an arg to another
// function returning a function pointer
check("void f() {\n"
" void *buf = malloc(1);\n"
" get_function()(get_function()(buf));\n"
"}\n");
ASSERT_EQUALS("", errout_str());

check("void f() {\n"
" void *buf = malloc(1);\n"
" get_function(buf)(get_function(NULL)(NULL));\n"
"}\n");
ASSERT_EQUALS("[test.c:4:1]: (information) --check-library: Function get_function() should have <use>/<leak-ignore> configuration [checkLibraryUseIgnore]\n", errout_str());
}

void goto1() {
check("static void f() {\n"
" int err = -ENOMEM;\n"
Expand Down
Loading