Skip to content

Fix #12494 fuzzing crash in CheckAutoVariables::checkAutoVariableAssignment() #6093

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
chrchr-github merged 4 commits into from
Mar 8, 2024
Merged

Fix #12494 fuzzing crash in CheckAutoVariables::checkAutoVariableAssignment() #6093

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
7ca2640
Fix #12494 fuzzing crash in CheckAutoVariables::checkAutoVariableAssi…
chrchr-github Mar 6, 2024
9f6e817
Fix
chrchr-github Mar 6, 2024
651b976
Fix
chrchr-github Mar 6, 2024
22d2472
clang-tidy
chrchr-github Mar 6, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion lib/tokenize.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6658,7 +6658,10 @@ Token *Tokenizer::simplifyAddBracesPair(Token *tok, bool commandWithCondition)
}
if (!tokEnd || tokEnd->str() != ";") {
// No trailing ;
return tok;
if (tokStatement->isUpperCaseName())
unknownMacroError(tokStatement);
else
syntaxError(tokStatement);
}
}

Expand Down
1 change: 1 addition & 0 deletions test/cli/fuzz-crash/crash-4d4e80f09d4733a9f724282d60ee4e3c3a143b61
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
d o(i*a){n b;*a=&b;if(a)r{}}
13 changes: 6 additions & 7 deletions test/testcondition.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2792,13 +2792,12 @@ class TestCondition : public TestFixture {
"}");
ASSERT_EQUALS("[test.cpp:2] -> [test.cpp:4]: (warning) Identical condition 'x>100', second condition is always false\n", errout.str());

check("void f(int x) {\n" // #8217 - crash for incomplete code
" if (x > 100) { return; }\n"
" X(do);\n"
" if (x > 100) {}\n"
"}");
// TODO: we should probably throw unknownMacro InternalError. Complain that the macro X must be defined. We can't check the code well without the definition.
ASSERT_EQUALS("[test.cpp:2] -> [test.cpp:4]: (style) Condition 'x>100' is always false\n", errout.str());
ASSERT_THROW(check("void f(int x) {\n" // #8217 - crash for incomplete code
" if (x > 100) { return; }\n"
" X(do);\n"
" if (x > 100) {}\n"
"}"),
InternalError);

check("void f(const int *i) {\n"
" if (!i) return;\n"
Expand Down
15 changes: 3 additions & 12 deletions test/testtokenize.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1139,12 +1139,7 @@ class TestTokenizer : public TestFixture {
" for (int k=0; k<VectorSize; k++)"
" LOG_OUT(ID_Vector[k])"
"}";
const char expected[] =
"void f ( ) { "
"for ( int k = 0 ; k < VectorSize ; k ++ ) "
"LOG_OUT ( ID_Vector [ k ] ) "
"}";
ASSERT_EQUALS(expected, tokenizeAndStringify(code));
ASSERT_THROW(tokenizeAndStringify(code), InternalError);
}

void ifAddBraces11() {
Expand Down Expand Up @@ -1367,16 +1362,12 @@ class TestTokenizer : public TestFixture {

{
const char code[] = "{ UNKNOWN_MACRO ( do ) ; while ( a -- ) ; }";
const char result[] = "{ UNKNOWN_MACRO ( do ) ; while ( a -- ) { ; } }";

ASSERT_EQUALS(result, tokenizeAndStringify(code));
ASSERT_THROW(tokenizeAndStringify(code), InternalError);
}

{
const char code[] = "{ UNKNOWN_MACRO ( do , foo ) ; while ( a -- ) ; }";
const char result[] = "{ UNKNOWN_MACRO ( do , foo ) ; while ( a -- ) { ; } }";

ASSERT_EQUALS(result, tokenizeAndStringify(code));
ASSERT_THROW(tokenizeAndStringify(code), InternalError);
}

{
Expand Down