Fix #15005: FP uninitdata with compound assignment or increment (#8822)

isVariableUsage() currently returns nullptr for the lhs of assignment
operators, because unless it's a pointer that gets dereferenced, it is
just getting overwritten and its potentially uninitialized value is not
read. I extend this idea to compound assignment and increment/decrement
operators.

While working on this, I found some issues with CTU analysis.
```
        valueFlowUninit("void increment(int& i) { ++i; }\n" // #6475
                        "int f() {\n"
                        "    int n;\n"
                        "    increment(n);\n"
                        "    return n;\n"
                        "}\n");
        ASSERT_EQUALS("[test.cpp:4:15] -> [test.cpp:1:28]: (warning) Uninitialized variable: i [uninitvar]\n", errout_str());
```
this test only works because of the false positive "usage" from the
increment operator. For example, this test breaks if we use regular
assignment because of the current code properly handling "="

this code
```
void increment(int& i) { i = i + 1; }
int f() {
    int n;
    increment(n);
    return n;
}
```
misses the ctu error, and only throws
```
Checking examples/ctu3.cpp ...
examples/ctu3.cpp:1:30: warning: Uninitialized variable: i [uninitvar]
void increment(int& i) { i = i + 1; }
                             ^
examples/ctu3.cpp:4:15: note: Calling function 'increment', 1st argument 'n' value is <Uninit>
    increment(n);
              ^
examples/ctu3.cpp:1:30: note: Uninitialized variable: i
void increment(int& i) { i = i + 1; }
                             ^
```

I think that the problem has to do with
```
// NOLINTNEXTLINE(readability-non-const-parameter) - used as callback so we need to preserve the signature
static bool isVariableUsage(const Settings &settings, const Token *vartok, MathLib::bigint *value)
{
    (void)value;
    return !!CheckUninitVarImpl::isVariableUsage(vartok, settings.library, true, CheckUninitVarImpl::Alloc::ARRAY);
}
```

the hardcoded pointer=true and alloc=ARRAY assignments tell
isVariableUsage to return nullptr if it i isn't dereferenced, which it
isn't. If we are going to hardcode these values to be this conservative
then this test should fail because it currently only passes due to the
FP bug I want to fix. I currently have a workaround where I use
vartok->variable() to determine whether something is actually a
pointer/array.

Maybe there can be another PR where we rework the ctu/uninitvar
connection. Notably since I don't touch the "=" branch of the code the
false negative I mentioned above remains unfixed. Let me know if I
should apply my vartok workaround to that code in this PR, if it should
be another PR, or if its just the wrong idea overall.

---------

Co-authored-by: Daniel Marjamäki <daniel.marjamaki@gmail.com>

Author: aadanen

lib/checkuninitvar.cpp

@@ -834,7 +834,7 @@ bool CheckUninitVarImpl::checkScopeForVariable(const Token *tok, const Variable&
                         }
                     }
                 }
-                if (Token::simpleMatch(parent->astParent(), "=") && astIsLHS(parent)) {
+                if (Token::Match(parent->astParent(), "%assign%") && astIsLHS(parent)) {
                     const Token *eq = parent->astParent();
                     if (const Token *errorToken = checkExpr(eq->astOperand2(), var, *alloc, number_of_if==0)) {
                         if (!suppressErrors)
@@ -1295,6 +1295,19 @@ const Token* CheckUninitVarImpl::isVariableUsage(const Token *vartok, const Libr
             }
             if (alloc != NO_ALLOC && astIsRhs(valueExpr))
                 return nullptr;
+        } else if (tok->astParent() && (tok->astParent()->isAssignmentOp() || tok->astParent()->isIncDecOp())) {
+            // NO_ALLOC -> no matter what we read the uninitialized memory.
+            // pointer/array -> safe, as long as we don't dereference
+            bool isPtr = pointer;
+            bool isArr = alloc == ARRAY;
+            // "pointer" and "alloc" get set for non-ptr non-array var
+            if (vartok && vartok->variable()) {
+                isPtr = vartok->variable()->isPointer();
+                isArr = vartok->variable()->isArray();
+            }
+            if ((alloc != NO_ALLOC) && ((isPtr || isArr) && !derefValue)) {
+                return nullptr;
+            }
         }
     }
 

test/testuninitvar.cpp

@@ -2202,6 +2202,58 @@ class TestUninitVar : public TestFixture {
                        "    return i;\n"
                        "}\n");
         ASSERT_EQUALS("", errout_str());
+
+        // #15005
+        checkUninitVar("void f() {\n"
+                       "    char *p = new char;\n"
+                       "    p += 1;\n"
+                       "    delete (p - 1);\n"
+                       "}\n");
+        ASSERT_EQUALS("", errout_str());
+
+        checkUninitVar("void f() {\n"
+                       "    char *p = new char;\n"
+                       "    *p += 1;\n"
+                       "    delete p;\n"
+                       "}\n");
+        ASSERT_EQUALS("[test.cpp:3:6]: (error) Memory is allocated but not initialized: p [uninitdata]\n", errout_str());
+
+        checkUninitVar("void f() {\n"
+                       "    char *p = new char;\n"
+                       "    (*p)++;\n"
+                       "    delete p;\n"
+                       "}\n");
+        ASSERT_EQUALS("[test.cpp:3:7]: (error) Memory is allocated but not initialized: p [uninitdata]\n", errout_str());
+
+        checkUninitVar("void f() {\n"
+                       "    char *p = new char;\n"
+                       "    p[0]++;\n"
+                       "    delete p;\n"
+                       "}\n");
+        ASSERT_EQUALS("[test.cpp:3:5]: (error) Memory is allocated but not initialized: p [uninitdata]\n", errout_str());
+
+        checkUninitVar("void f() {\n"
+                       "    char *buf = (char *)malloc(1);\n"
+                       "    if (!buf)\n"
+                       "        return NULL;\n"
+                       "    buf += buf[0];\n"
+                       "    free(buf);\n"
+                       "}\n");
+        ASSERT_EQUALS("[test.cpp:5:15]: (error) Memory is allocated but not initialized: buf[0] [uninitdata]\n", errout_str());
+
+        checkUninitVar("void g() {\n"
+                       "    int* p = new int;\n"
+                       "    p++;\n"
+                       "    delete (p - 1);\n"
+                       "}\n");
+        ASSERT_EQUALS("", errout_str());
+
+        checkUninitVar("void g() {\n"
+                       "    int* p = new int;\n"
+                       "    ++p;\n"
+                       "    delete (p - 1);\n"
+                       "}\n");
+        ASSERT_EQUALS("", errout_str());
     }
 
     // class / struct..
@@ -8177,6 +8229,16 @@ class TestUninitVar : public TestFixture {
             "}\n");
         ASSERT_EQUALS("[test.cpp:6:4] -> [test.cpp:2:10]: (error) Using argument p that points at uninitialized variable x [ctuuninitvar]\n", errout_str());
 
+        ctu("void f(int *p) {\n"
+            "    a += *p;\n"
+            "}\n"
+            "int main() {\n"
+            "  int x;\n"
+            "  f(&x);\n"
+            "}\n");
+        ASSERT_EQUALS("[test.cpp:6:4] -> [test.cpp:2:11]: (error) Using argument p that points at uninitialized variable x [ctuuninitvar]\n", errout_str());
+
+
         ctu("void use(int *p) { a = *p + 3; }\n"
             "void call(int x, int *p) { x++; use(p); }\n"
             "int main() {\n"