Skip to content

Commit 9fab9b9

Browse files
chrchr-githubchrchr-github
authored
Fix #12643-46 fuzzing crashes (cppcheck-opensource#6336)
1 parent 7dab204 commit 9fab9b9

6 files changed

Lines changed: 13 additions & 3 deletions

‎lib/tokenize.cpp‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8690,6 +8690,12 @@ void Tokenizer::findGarbageCode() const
86908690
syntaxError(tok);
86918691
if (Token::Match(tok, "^ %op%") && !Token::Match(tok->next(), "[>*+-!~]"))
86928692
syntaxError(tok);
8693+
if (Token::Match(tok, ": [)]=]"))
8694+
syntaxError(tok);
8695+
if (Token::Match(tok, "typedef [,;]"))
8696+
syntaxError(tok);
8697+
if (Token::Match(tok, "! %comp%"))
8698+
syntaxError(tok);
86938699

86948700
if (tok->link() && Token::Match(tok, "[([]") && (!tok->tokAt(-1) || !tok->tokAt(-1)->isControlFlowKeyword())) {
86958701
const Token* const end = tok->link();

‎test/cli/fuzz-crash/crash-28733cc31fd7f5d636beeaa3fa2bc30779fc6487‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
assert({:=4;})

‎test/cli/fuzz-crash/crash-3275671bf6888060270f902458ff36c711718e22‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
v o(i a){$ i;for(i:)a=[]0;}

‎test/cli/fuzz-crash/crash-58e1517a74e314553e8eef249268cec29493235b‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
n a(){!!=!!?:b}

‎test/cli/fuzz-crash/crash-a431ec7f7379fc460eaa6284627091ded6c0d696‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
{for(typedef,typedef;);}

‎test/testgarbage.cpp‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -862,7 +862,7 @@ class TestGarbage : public TestFixture {
862862
ASSERT_THROW_INTERNAL_EQUALS(checkCode("{ xs :: i(:) ! ! x/5 ! !\n"
863863
"i, :: a :: b integer, } foo2(x) :: j(:)\n"
864864
"b type(*), d(:), a x :: end d(..), foo end\n"
865-
"foo4 b d(..), a a x type(*), b foo2 b"), INTERNAL, "Internal error. AST cyclic dependency.");
865+
"foo4 b d(..), a a x type(*), b foo2 b"), SYNTAX, "syntax error");
866866
}
867867

868868
void garbageCode100() { // #6840
@@ -987,7 +987,7 @@ class TestGarbage : public TestFixture {
987987
}
988988

989989
void garbageCode125() {
990-
ASSERT_THROW_INTERNAL(checkCode("{ T struct B : T valueA_AA ; } T : [ T > ( ) { B } template < T > struct A < > : ] { ( ) { return valueA_AC struct { : } } b A < int > AC ( ) a_aa.M ; ( ) ( ) }"), UNKNOWN_MACRO);
990+
ASSERT_THROW_INTERNAL(checkCode("{ T struct B : T valueA_AA ; } T : [ T > ( ) { B } template < T > struct A < > : ] { ( ) { return valueA_AC struct { : } } b A < int > AC ( ) a_aa.M ; ( ) ( ) }"), SYNTAX);
991991
ASSERT_THROW_INTERNAL(checkCode("template < Types > struct S :{ ( S < ) S >} { ( ) { } } ( ) { return S < void > ( ) }"),
992992
SYNTAX);
993993
}
@@ -1661,7 +1661,7 @@ class TestGarbage : public TestFixture {
16611661

16621662
void garbageCode206() {
16631663
ASSERT_EQUALS("[test.cpp:1] syntax error: operator", getSyntaxError("void foo() { for (auto operator new : int); }"));
1664-
ASSERT_EQUALS("[test.cpp:1] syntax error: operator", getSyntaxError("void foo() { for (a operator== :) }"));
1664+
ASSERT_EQUALS("[test.cpp:1] syntax error", getSyntaxError("void foo() { for (a operator== :) }"));
16651665
}
16661666

16671667
void garbageCode207() { // #8750

0 commit comments

Comments
 (0)