Fix 14924: FP containerOutOfBounds (copy accessed in loop) (#8740)

Co-authored-by: Your Name <you@example.com>

Author: pfultz2

lib/programmemory.cpp

@@ -1512,6 +1512,31 @@ namespace {
             return unknown();
         }
 
+        // Get the size of the container. If the container itself is not tracked in the program
+        // memory then check if it is symbolically equal to a container whose size is tracked.
+        ValueFlow::Value executeContainerSize(const Token* containerTok)
+        {
+            ValueFlow::Value v = execute(containerTok);
+            if (v.isContainerSizeValue())
+                return v;
+            for (const ValueFlow::Value& value : containerTok->values()) {
+                if (!value.isSymbolicValue())
+                    continue;
+                if (value.isImpossible())
+                    continue;
+                if (value.intvalue != 0)
+                    continue;
+                if (!value.tokvalue)
+                    continue;
+                if (value.tokvalue->exprId() == 0)
+                    continue;
+                const ValueFlow::Value* sizeValue = pm->getValue(value.tokvalue->exprId());
+                if (sizeValue && sizeValue->isContainerSizeValue())
+                    return *sizeValue;
+            }
+            return unknown();
+        }
+
         ValueFlow::Value executeImpl(const Token* expr)
         {
             const ValueFlow::Value* value = nullptr;
@@ -1540,14 +1565,14 @@ namespace {
                 const Token* containerTok = expr->tokAt(-2)->astOperand1();
                 const Library::Container::Yield yield = containerTok->valueType()->container->getYield(expr->strAt(-1));
                 if (yield == Library::Container::Yield::SIZE) {
-                    ValueFlow::Value v = execute(containerTok);
+                    ValueFlow::Value v = executeContainerSize(containerTok);
                     if (!v.isContainerSizeValue())
                         return unknown();
                     v.valueType = ValueFlow::Value::ValueType::INT;
                     return v;
                 }
                 if (yield == Library::Container::Yield::EMPTY) {
-                    ValueFlow::Value v = execute(containerTok);
+                    ValueFlow::Value v = executeContainerSize(containerTok);
                     if (!v.isContainerSizeValue())
                         return unknown();
                     if (v.isImpossible() && v.intvalue == 0)

test/teststl.cpp

@@ -1003,6 +1003,18 @@ class TestStl : public TestFixture {
                     "}\n");
         ASSERT_EQUALS("[test.cpp:2:13]: error: Out of bounds access in 'v[2]', if 'v' size is 1 and '2' is 2 [containerOutOfBounds]\n",
                       errout_str());
+
+        checkNormal("std::string f(const std::string& str) {\n" // do not warn, the copy has the same size as 'str'
+                    "    std::string outStr = str;\n"
+                    "    if (!outStr.empty())\n"
+                    "        outStr[0] = 'a';\n"
+                    "    for (int i = 0; i < str.size(); ++i) {\n"
+                    "        if (outStr[i] == '_')\n"
+                    "            outStr[i] = ' ';\n"
+                    "    }\n"
+                    "    return outStr;\n"
+                    "}\n");
+        ASSERT_EQUALS("", errout_str());
     }
 
     void outOfBoundsSymbolic()