[aadanen]

Modify checkleakautovar to consider calls to lambdas and function pointers as function calls that can allow resources to escape the current scope.

[aadanen]

I am suprised to see all these segmentation faults. In my testing everything seemed to work nicely but I guess it was just crashing silently and working properly. I will need to modify functionCall() more heavily to not send nullptr to the library functions. This kinda undermines my idea of reusing functionCall for anonymous functions but I still think it is better than duplicating the function.

[aadanen]

I switched from the makefile to cmake and ran the CI workflows locally so I think next time they run, they should pass. Sorry about that. Also I noticed that git was using my work account, so I sorted that out too.

[danmar]

I am not sure why but there was significant slowdown in CI (selfchecking) after this?

[aadanen]

Thanks for the review! I will look into it more on monday.

[aadanen]

I found the issue with the selfcheck slowdown. isAnonymousFunctionCall would sometimes link() backwards causing the checker to loop forever.

void f(char ch16) {
    ch = static_cast<unsigned char>(((ch16 >= 0x80) ? 0xff : ch16));
}

[aadanen]

the sanitizers/build check failed because of some network thing:
Connecting to apt.llvm.org (apt.llvm.org)|2a04:4e42:8a::561|:443... failed: Network is unreachable.
I think it probably just needs to be re-run.

Thanks!

[danmar]

@aadanen I can't retrigger it now. maybe it's too old. can you please make a new commit to retrigger the CI

[dmcppcheck]

AI review

New problem: a lost deallocuse warning. On the merge-base, passing a freed pointer to a call through a function pointer (free(p); (*cb)(p);) or to the result of a call (free(p); get()(p);) gives deallocuse. With this PR the warning is gone. The new branches set tok = lpar->link() (and return anonOpeningPar->link()), so the arguments never reach the dealloc‑use check in checkTokenInsideExpression. Calls through plain names (foo(p), cb(p)) do not warn on the merge-base either. So this warning was specific to these call forms, but it was a real use-after-free detection and the PR drops it silently.

The FP is only partly fixed. It is fixed for (*cb)(p), (s->fp)(p), (*s.fp)(p), (*fps[0])(p), (c ? a : b)(p) and get()(p). It remains for function-pointer calls through a subscript, such as fps[0](p) and s->fps[1](p) (dispatch tables), and for chained calls like get2()()(p).

I found no crash, hang or slowdown. I also found no other result changes on the cfg test files.

Testing

• I built cppcheck and testrunner in pr/, and cppcheck in base/.
• ./testrunner TestLeakAutoVar TestLeakAutoVarStrcpy TestLeakAutoVarRecursiveCountLimit TestLeakAutoVarWindows TestLeakAutoVarPosix ran 161 tests with 0 failures.
• I ran base and PR on test/cfg/{posix,std,gnu}.c, test/cfg/{std,windows}.cpp and lib/checkleakautovar.cpp. The output was identical, and the run time was the same (215s vs 214s).
• I tried about 40 small cases: function pointers, lambdas (including immediately invoked ones), functors, casts, sizeof, conditions, assignments, and nested or chained calls. The intended cases improve. There were no new false positives besides the one already raised in comments.md.

Regression: deallocuse is lost (c1.c)

#include <stdlib.h>
typedef void (*fn_t)(void*);
fn_t get(void);
void u1(void (*cb)(void*)) {
    char *p = malloc(10);
    free(p);
    (*cb)(p);
}
void u3(void) {
    char *p = malloc(10);
    free(p);
    get()(p);
}

Command: cppcheck -q --template='{line}:{column}:{id}' c1.c

• base: 7:11:deallocuse and 12:11:deallocuse
• PR: no output

FPs that remain (d1.c)

#include <stdlib.h>
typedef void (*fn_t)(void*);
typedef fn_t (*fn2_t)(void);
fn2_t get2(void);
struct S { fn_t fps[2]; };
void k1(fn_t *fps) { char *p = malloc(10); fps[0](p); }
void k4(struct S *s) { char *p = malloc(10); s->fps[1](p); }
void k5(void) { char *p = malloc(10); get2()()(p); }

The PR still reports memleak for all three functions, the same as base. Base and PR agree on these cases; the PR only fixes the parenthesised forms.

---

Automated review of cd4f032 by Claude. The pull request was built and tested locally.

[dmcppcheck]

Test results for commit cd4f032 (tools/test-my-pr.py, main compared to this PR):

Test: http://ec2-16-170-140-253.eu-north-1.compute.amazonaws.com/pr-8813/
packages: 100
Differing warnings: 0 (+0 -0)
Timing: +1.8% (http://ec2-16-170-140-253.eu-north-1.compute.amazonaws.com/pr-8813/2026-10-25_21-08-26-cd4f0320eb6d_timing.html)

_{Posted automatically by the cppcheck PR test runner. +N: warnings only with this PR, -N: warnings only with main. The AI review is written by Claude and can be wrong.}