From 1a6f7ea9a0f641d0cc2c2fbb5fabb17577aa3884 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20Marjam=C3=A4ki?= <danielm77@spray.se>
Date: Thu, 26 Jul 2012 11:12:28 +0200
Subject: [PATCH] Fixed #3998 (Tokenizer::simplifyEnum: wrong handling of
 expressions => crash)

---
 lib/tokenize.cpp            | 25 ++++++++-----------------
 test/testsimplifytokens.cpp |  8 +++++++-
 2 files changed, 15 insertions(+), 18 deletions(-)

diff --git a/lib/tokenize.cpp b/lib/tokenize.cpp
index 6ed79dda8..1125f1dc6 100644
--- a/lib/tokenize.cpp
+++ b/lib/tokenize.cpp
@@ -7048,7 +7048,7 @@ void Tokenizer::simplifyEnum()
                         // value is previous expression + 1
                         tok1->insertToken("+");
                         tok1 = tok1->next();
-                        tok1->insertToken(MathLib::toString<MathLib::bigint>(lastValue));
+                        tok1->insertToken("1");
                         enumValue = 0;
                         enumValueStart = valueStart->next();
                         enumValueEnd = tok1->next();
@@ -7072,19 +7072,10 @@ void Tokenizer::simplifyEnum()
                     enumValueStart = tok1;
                     enumValueEnd = tok1;
                     int level = 0;
-                    if (enumValueEnd->str() == "(" ||
-                        enumValueEnd->str() == "[" ||
-                        enumValueEnd->str() == "{")
-                        ++level;
-                    while (enumValueEnd->next() &&
-                           (!Token::Match(enumValueEnd->next(), "}|,") || level)) {
-                        if (enumValueEnd->next()->str() == "(" ||
-                            enumValueEnd->next()->str() == "[" ||
-                            enumValueEnd->next()->str() == "{")
+                    while (enumValueEnd->next() && (!Token::Match(enumValueEnd->next(), "[},]") || level)) {
+                        if (Token::Match(enumValueEnd, "(|["))
                             ++level;
-                        else if (enumValueEnd->next()->str() == ")" ||
-                                 enumValueEnd->next()->str() == "]" ||
-                                 enumValueEnd->next()->str() == "}")
+                        else if (Token::Match(enumValueEnd->next(), "]|)"))
                             --level;
 
                         enumValueEnd = enumValueEnd->next();
@@ -7101,11 +7092,11 @@ void Tokenizer::simplifyEnum()
                     EnumValue ev(enumName, enumValue, enumValueStart, enumValueEnd);
                     ev.simplify(enumValues);
                     enumValues[enumName->str()] = ev;
-                    if (ev.start == NULL) {
-                        tok1 = ev.value;
-                        lastEnumValueStart = lastEnumValueEnd = NULL;
+                    lastEnumValueStart = ev.start;
+                    lastEnumValueEnd = ev.end;
+                    if (ev.start == NULL)
                         lastValue = MathLib::toLongNumber(ev.value->str());
-                    }
+                    tok1 = ev.end ? ev.end : ev.value;
                 }
             }
 
diff --git a/test/testsimplifytokens.cpp b/test/testsimplifytokens.cpp
index 9c9725e7f..c2dc1d284 100644
--- a/test/testsimplifytokens.cpp
+++ b/test/testsimplifytokens.cpp
@@ -348,6 +348,7 @@ private:
         TEST_CASE(enum29); // ticket #3747 (bitwise or value)
         TEST_CASE(enum30); // ticket #3852 (false positive)
         TEST_CASE(enum31); // ticket #3934 (calculation in first item)
+        TEST_CASE(enum32); // ticket #3998 (access violation)
 
         // remove "std::" on some standard functions
         TEST_CASE(removestd);
@@ -6702,7 +6703,7 @@ private:
                                 "1 + sizeof ( int ) + "
                                 "1 + sizeof ( int ) + 100 + "
                                 "1 + sizeof ( int ) + 100 + 1 + "
-                                "1 + sizeof ( int ) + 100 + 2 + "
+                                "1 + sizeof ( int ) + 100 + 1 + 1 + "
                                 "90 + "
                                 "91 ;";
 
@@ -7033,6 +7034,11 @@ private:
         ASSERT_EQUALS("i = 65 ;", checkSimplifyEnum(code));
     }
 
+    void enum32() {  // #3998 - wrong enum simplification => access violation
+        const char code[] = "enum { x=(32), y=x, z }; { a, z }";
+        ASSERT_EQUALS("{ a , ( 32 ) + 1 }", checkSimplifyEnum(code));
+    }
+
     void removestd() {
         ASSERT_EQUALS("; strcpy ( a , b ) ;", tok("; std::strcpy(a,b);"));
         ASSERT_EQUALS("; strcat ( a , b ) ;", tok("; std::strcat(a,b);"));