fix #12781: FP doubleFree with fdopen() (danmar#6974)

Author: ludviggunne

lib/checkleakautovar.cpp

@@ -913,6 +913,12 @@ void CheckLeakAutoVar::changeAllocStatus(VarInfo &varInfo, const VarInfo::AllocI
     std::map<int, VarInfo::AllocInfo> &alloctype = varInfo.alloctype;
     const std::map<int, VarInfo::AllocInfo>::iterator var = alloctype.find(arg->varId());
     if (var != alloctype.end()) {
+        // bailout if function is also allocating, since the argument might be moved
+        // to the return value, such as in fdopen
+        if (allocation.allocTok && mSettings->library.getAllocFuncInfo(allocation.allocTok)) {
+            varInfo.erase(arg->varId());
+            return;
+        }
         if (allocation.status == VarInfo::NOALLOC) {
             // possible usage
             varInfo.possibleUsage[arg->varId()] = { tok, VarInfo::USED };

test/testleakautovar.cpp

@@ -73,6 +73,7 @@ class TestLeakAutoVar : public TestFixture {
         TEST_CASE(realloc5); // #9292, #9990
         TEST_CASE(freopen1);
         TEST_CASE(freopen2);
+        TEST_CASE(fdopen); // #12781
 
         TEST_CASE(deallocuse1);
         TEST_CASE(deallocuse3);
@@ -760,6 +761,22 @@ class TestLeakAutoVar : public TestFixture {
         ASSERT_EQUALS("[test.c:4]: (error) Resource leak: q\n", errout_str());
     }
 
+    void fdopen() { // #12781
+        check("void foo(void) {\n"
+              "    int fd;\n"
+              "    FILE *stream;\n"
+              "    fd = open(\"/foo\", O_RDONLY);\n"
+              "    if (fd == -1) return;\n"
+              "    stream = fdopen(fd, \"r\");\n"
+              "    if (!stream) {\n"
+              "        close(fd);\n"
+              "        return;\n"
+              "    }\n"
+              "    fclose(stream);\n"
+              "}\n");
+        ASSERT_EQUALS("", errout_str());
+    }
+
     void deallocuse1() {
         check("void f(char *p) {\n"
               "    free(p);\n"