Fix #15006: FP invalidFree with new array

lib/checkother.cpp

@@ -2850,6 +2850,13 @@ void CheckOtherImpl::checkInvalidFree()
 
                 const int varIndex = tok->strAt(1) == "(" ? 2 :
                                      tok->strAt(3) == "(" ? 4 : 1;
+                const Token *op = tok->tokAt(varIndex + 1);
+                if (std::any_of(op->values().cbegin(),
+                                op->values().cend(),
+                                [&](const ValueFlow::Value &value) {
+                    return value.isSymbolicValue() && value.intvalue == 0;
+                }))
+                    continue;
                 const int var1 = tok->tokAt(varIndex)->varId();
                 const int var2 = tok->tokAt(varIndex + 2)->varId();
                 const auto alloc1 = utils::as_const(inconclusive).find(var1);

lib/valueflow.cpp

@@ -3737,6 +3737,20 @@ static void valueFlowSymbolicOperators(const SymbolDatabase& symboldatabase, con
                     continue;
                 if (Token::Match(tok, "<<|>>|/|-") && !astIsLHS(vartok))
                     continue;
+                if (Token::Match(tok, "+|-") && constant->intvalue != 0) {
+                    std::unordered_set<nonneg int> ids;
+                    for (const auto &value : vartok->values()) {
+                        if (!value.isSymbolicValue())
+                            continue;
+                        if (!value.tokvalue)
+                            continue;
+                        if (!ids.insert(value.tokvalue->exprId()).second)
+                            continue;
+                        ValueFlow::Value newValue(value);
+                        newValue.intvalue += tok->str() == "-" ? -constant->intvalue : constant->intvalue;
+                        setTokenValue(tok, std::move(newValue), settings);
+                    }
+                }
                 if (Token::Match(tok, "<<|>>|^|+|-|%or%") && constant->intvalue != 0)
                     continue;
                 if (Token::Match(tok, "*|/") && constant->intvalue != 1)

test/testother.cpp

@@ -10070,6 +10070,22 @@ class TestOther : public TestFixture {
         ASSERT_EQUALS(
             "[test.cpp:2:9]: (style) Variable 'ptr' can be declared as pointer to const [constVariablePointer]\n",
             errout_str());
+
+        check("void f() {\n"
+              "    char *p = new char[1];\n"
+              "    ++p;\n"
+              "    delete [] (p - 1);\n"
+              "}\n");
+        ASSERT_EQUALS("[test.cpp:2:11]: (style) Variable 'p' can be declared as pointer to const [constVariablePointer]\n",
+                      errout_str());
+
+        check("void f() {\n"
+              "    char *p = new char[1];\n"
+              "    delete [] (p - 1);\n"
+              "}\n");
+        ASSERT_EQUALS("[test.cpp:2:11]: (style) Variable 'p' can be declared as pointer to const [constVariablePointer]\n"
+                      "[test.cpp:3:5]: (error) Mismatching address is deleted. The address you get from new must be deleted without offset. [invalidFree]\n"
+                      , errout_str());
     }
 
     void checkRedundantCopy() {