fix #11542: FP memleak when using memcpy() with pointer

lib/checkleakautovar.cpp

@@ -363,6 +363,54 @@ bool CheckLeakAutoVar::checkScope(const Token * const startToken,
         while (Token::Match(ftok, "%name% :: %name%"))
             ftok = ftok->tokAt(2);
 
+        // memcpy / memmove
+        if (Token::Match(varTok, "memcpy|memmove")) {
+            const std::vector<const Token*> args = getArguments(varTok);
+            // too few args for memcpy / memmove call
+            if (args.size() < 3)
+                continue;
+            const Token *dst = args[0];
+            const Token *src = args[1];
+
+            // check that dst arg is pointer to pointer
+            int dstIndirectionLevel = 0;
+            while (dst->str() == "*") {
+                dst = dst->astOperand1();
+                dstIndirectionLevel--;
+            }
+            if (dst->str() == "&") {
+                dst = dst->astOperand1();
+                dstIndirectionLevel++;
+            }
+            if (!dst->isVariable())
+                continue;
+            if (dstIndirectionLevel + dst->variable()->valueType()->pointer != 2)
+                continue;
+
+            // check that src arg is pointer to pointer
+            int srcIndirectionLevel = 0;
+            while (src->str() == "*") {
+                src = src->astOperand1();
+                srcIndirectionLevel--;
+            }
+            if (src->str() == "&") {
+                src = src->astOperand1();
+                srcIndirectionLevel++;
+            }
+            if (!src->isVariable())
+                continue;
+            if (srcIndirectionLevel + src->variable()->valueType()->pointer != 2)
+                continue;
+
+            if (!dst->variable()->isArgument()) {
+                varInfo.alloctype[dst->varId()].status = VarInfo::AllocStatus::ALLOC;
+            }
+
+            // no multivariable checking currently (see assignment below)
+            // treat source pointer as unallocated
+            varInfo.erase(src->varId());
+        }
+
         auto isAssignment = [](const Token* varTok) -> const Token* {
             if (varTok->varId()) {
                 const Token* top = varTok;

test/testleakautovar.cpp

@@ -64,6 +64,9 @@ class TestLeakAutoVar : public TestFixture {
         TEST_CASE(assign25);
         TEST_CASE(assign26);
 
+        TEST_CASE(memcpyWithPtr1); // #11542
+        TEST_CASE(memcpyWithPtr2);
+
         TEST_CASE(isAutoDealloc);
 
         TEST_CASE(realloc1);
@@ -633,6 +636,25 @@ class TestLeakAutoVar : public TestFixture {
         ASSERT_EQUALS("", errout_str());
     }
 
+    void memcpyWithPtr1() { // #11542
+        const Settings s = settingsBuilder().library("std.cfg").library("posix.cfg").build();
+        check("void f(char** old, char* value) {\n"
+              "    char *str = strdup(value);\n"
+              "    memcpy(old, &str, sizeof(char*));\n"
+              "}\n", &s);
+        ASSERT_EQUALS("", errout_str());
+    }
+
+    void memcpyWithPtr2() {
+        const Settings s = settingsBuilder().library("std.cfg").library("posix.cfg").build();
+        check("void f(char* value) {\n"
+              "    char *old = NULL;\n"
+              "    char *str = strdup(value);\n"
+              "    memcpy(&old, &str, sizeof(char*));\n"
+              "}\n", &s);
+        ASSERT_EQUALS("[test.cpp:5]: (error) Memory leak: old\n", errout_str());
+    }
+
     void isAutoDealloc() {
         check("void f() {\n"
               "    char *p = new char[100];"