From 0a8ca1f160bf635f63e4e7d936a65fac995af779 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20Marjam=C3=A4ki?= <danielm77@spray.se>
Date: Sat, 16 Jan 2010 13:56:57 +0100
Subject: [PATCH] Fixed #1271 (SIGSEGV on malformed source (macro stub +
 fundef))

---
 lib/cppcheck.cpp |  5 +++++
 lib/tokenize.cpp | 15 +++++++--------
 2 files changed, 12 insertions(+), 8 deletions(-)

diff --git a/lib/cppcheck.cpp b/lib/cppcheck.cpp
index a1ec3d230..528cf4cca 100644
--- a/lib/cppcheck.cpp
+++ b/lib/cppcheck.cpp
@@ -555,6 +555,11 @@ void CppCheck::checkFile(const std::string &code, const char FileName[])
             return;
     }
 
+    {
+        TIMER_START();
+        _tokenizer.fillFunctionList();
+        TIMER_END("Tokenizer::fillFunctionList");
+    }
 
     if (_settings.isEnabled("unusedFunctions") && _settings._jobs == 1)
         _checkUnusedFunctions.parseTokens(_tokenizer);
diff --git a/lib/tokenize.cpp b/lib/tokenize.cpp
index c88f0d705..f2fa8725f 100644
--- a/lib/tokenize.cpp
+++ b/lib/tokenize.cpp
@@ -2213,6 +2213,9 @@ void Tokenizer::simplifySizeof()
 
 bool Tokenizer::simplifyTokenList()
 {
+    // clear the _functionList so it can't contain dead pointers
+    _functionList.clear();
+
     for (Token *tok = _tokens; tok; tok = tok->next())
     {
         if (Token::simpleMatch(tok, "* const"))
@@ -4655,17 +4658,13 @@ void Tokenizer::fillFunctionList()
 {
     _functionList.clear();
 
-    int indentlevel = 0;
     for (const Token *tok = _tokens; tok; tok = tok->next())
     {
         if (tok->str() == "{")
-            ++indentlevel;
-
-        else if (tok->str() == "}")
-            --indentlevel;
-
-        if (indentlevel > 0)
         {
+            tok = tok->link();
+            if (!tok)
+                break;
             continue;
         }
 
@@ -4695,7 +4694,7 @@ void Tokenizer::fillFunctionList()
                     else
                     {
                         tok = tok2;
-                        while (tok->next() && !strchr(";{", tok->strAt(1)[0]))
+                        while (tok->next() && !Token::Match(tok->next(), "[;{]"))
                             tok = tok->next();
                     }
                     break;