False negative: array bounds missed with an address expression

[Rodri]

Hi, I found a false negative regarding the rule arrayIndexOutOfBounds.

Cppcheck misses an out-of-bounds write when the array expression is written as the address of its first element.

int a[2];

void f() {
  (&a[0])[2] = 0;
}

Actual result

Cppcheck does not report arrayIndexOutOfBounds. Replacing (&a[0])[2] = 0 with a[2] = 0 produces the warning. The form ((int *)a)[2] = 0 is also missed.

Expected result

Cppcheck should report the out-of-bounds write in these equivalent subscript forms.

Verification

The issue was reproduced with:

cppcheck --output-format=xmlv2 --enable=all array_expression.cpp

Version: 2.21.0

[CHR]

Thanks for reporting, ticket is here: https://trac.cppcheck.net/ticket/15074