From 382f21a5c926368dadb4be769c4dd238b83421cb Mon Sep 17 00:00:00 2001
From: Georgy Komarov <jubnzv@gmail.com>
Date: Sat, 18 Jul 2020 07:02:12 +0300
Subject: [PATCH]  Fixed crash on garbage code: comparisson with an empty
 second operand

This will fix #9774.
---
 lib/tokenize.cpp      | 17 ++++++++++++-----
 test/testgarbage.cpp  |  2 +-
 test/testtokenize.cpp |  5 ++++-
 3 files changed, 17 insertions(+), 7 deletions(-)

diff --git a/lib/tokenize.cpp b/lib/tokenize.cpp
index a9fa35bea..196653206 100644
--- a/lib/tokenize.cpp
+++ b/lib/tokenize.cpp
@@ -9624,11 +9624,18 @@ void Tokenizer::findGarbageCode() const
             if (match1 && match2)
                 syntaxError(tok);
         }
-        if (Token::Match(tok, "%or%|%oror%|~|^|!|%comp%|+|-|/|% )|]|}")) {
-            if (isC())
-                syntaxError(tok, tok->str() + tok->next()->str());
-            if (tok->str() != ">" && !Token::simpleMatch(tok->previous(), "operator"))
-                syntaxError(tok, tok->str() + " " + tok->next()->str());
+        if (Token::Match(tok, "%or%|%oror%|~|^|!|%comp%|+|-|/|%")) {
+            std::string code = "";
+            if (Token::Match(tok->next(), ")|]|}"))
+                code = tok->str() + tok->next()->str();
+            if (Token::simpleMatch(tok->next(), "( )"))
+                code = tok->str() + "()";
+            if (!code.empty()) {
+                if (isC())
+                    syntaxError(tok, code);
+                if (tok->str() != ">" && !Token::simpleMatch(tok->previous(), "operator"))
+                    syntaxError(tok, code);
+            }
         }
         if (Token::Match(tok, "%num%|%bool%|%char%|%str% %num%|%bool%|%char%|%str%") && !Token::Match(tok, "%str% %str%"))
             syntaxError(tok);
diff --git a/test/testgarbage.cpp b/test/testgarbage.cpp
index 48c1df944..814d2ac21 100644
--- a/test/testgarbage.cpp
+++ b/test/testgarbage.cpp
@@ -1402,7 +1402,7 @@ private:
 
     void garbageCode164() {
         //7234
-        checkCode("class d{k p;}(){d::d():B<()}");
+        ASSERT_THROW(checkCode("class d{k p;}(){d::d():B<()}"), InternalError);
     }
 
     void garbageCode165() {
diff --git a/test/testtokenize.cpp b/test/testtokenize.cpp
index 361c396a8..4d2705d9e 100644
--- a/test/testtokenize.cpp
+++ b/test/testtokenize.cpp
@@ -8087,7 +8087,7 @@ private:
         ASSERT_THROW(tokenizeAndStringify("void foo() { for_chain( if (!done) done = 1); }"), InternalError);
         ASSERT_THROW(tokenizeAndStringify("void foo() { for_chain( a, b, if (!done) done = 1); }"), InternalError);
 
-        ASSERT_THROW_EQUALS(tokenizeAndStringify("void f() { if (retval==){} }"), InternalError, "syntax error: == )");
+        ASSERT_THROW_EQUALS(tokenizeAndStringify("void f() { if (retval==){} }"), InternalError, "syntax error: ==)");
 
         // after (expr)
         ASSERT_NO_THROW(tokenizeAndStringify("void f() { switch (a) int b; }"));
@@ -8108,6 +8108,9 @@ private:
 
         // Ticket #9664
         ASSERT_NO_THROW(tokenizeAndStringify("S s = { .x { 2 }, .y[0] { 3 } };"));
+
+        ASSERT_THROW_EQUALS(tokenizeAndStringify("void f() { assert(a==()); }"), InternalError, "syntax error: ==()");
+        ASSERT_THROW_EQUALS(tokenizeAndStringify("void f() { assert(a+()); }"), InternalError, "syntax error: +()");
     }