Fix #14729: False positive: uninitdata reported for ternary operator that does not dereference buffer (#8550)

Author: ludviggunne

lib/checkuninitvar.cpp

@@ -383,7 +383,7 @@ static bool isVariableUsed(const Token *tok, const Variable& var)
         return isVariableUsed(tok->astOperand1(),var) || isVariableUsed(tok->astOperand2(),var);
     if (tok->varId() != var.declarationId())
         return false;
-    if (!var.isArray())
+    if (!var.isArray() && !var.isPointer())
         return true;
 
     const Token *parent = tok->astParent();

test/testuninitvar.cpp

@@ -80,7 +80,8 @@ class TestUninitVar : public TestFixture {
         TEST_CASE(uninitvar_unconditionalTry);
         TEST_CASE(uninitvar_funcptr); // #6404
         TEST_CASE(uninitvar_operator); // #6680
-        TEST_CASE(uninitvar_ternaryexpression); // #4683
+        TEST_CASE(uninitvar_ternaryexpression1); // #4683
+        TEST_CASE(uninitvar_ternaryexpression2); // #14729
         TEST_CASE(uninitvar_pointertoarray);
         TEST_CASE(uninitvar_cpp11ArrayInit); // #7010
         TEST_CASE(uninitvar_rangeBasedFor); // #7078
@@ -5447,7 +5448,7 @@ class TestUninitVar : public TestFixture {
         ASSERT_EQUALS("", errout_str());
     }
 
-    void uninitvar_ternaryexpression() { // #4683
+    void uninitvar_ternaryexpression1() { // #4683
         checkUninitVar("struct B { int asd; };\n"
                        "int f() {\n"
                        "    int a=0;\n"
@@ -5461,6 +5462,14 @@ class TestUninitVar : public TestFixture {
         ASSERT_EQUALS("", errout_str());
     }
 
+    void uninitvar_ternaryexpression2() { // #14729
+        checkUninitVar("void f(bool b, int i) {\n"
+                       "    int *p = (int*) malloc(4);\n"
+                       "    int *q = b ? p : &i;\n"
+                       "}\n");
+        ASSERT_EQUALS("", errout_str());
+    }
+
     void uninitvar_rangeBasedFor() {
         checkUninitVar("void function(Entry& entry) {\n" // #7078
                        "    for (auto* expr : entry.exprs) {\n"