From 56d176e1cefabf19748a21abe6cd92cb840f67ff Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20Marjam=C3=A4ki?= <danielm77@spray.se>
Date: Sun, 16 May 2010 20:21:22 +0200
Subject: [PATCH] Fixed #1684 (false positive: buffer access out of bounds when
 using extern variable declaration)

---
 lib/tokenize.cpp      | 12 +++++++++---
 test/testtokenize.cpp |  8 ++++++++
 2 files changed, 17 insertions(+), 3 deletions(-)

diff --git a/lib/tokenize.cpp b/lib/tokenize.cpp
index 5a89f1559..23e5e6ebe 100644
--- a/lib/tokenize.cpp
+++ b/lib/tokenize.cpp
@@ -4381,12 +4381,18 @@ void Tokenizer::simplifyVarDecl()
             }
         }
 
-        else if (Token::Match(tok2, "%type% %var% [ %num% ] ,|=") ||
-                 Token::Match(tok2, "%type% %var% [ %var% ] ,|="))
+        else if (Token::Match(tok2, "%type% %var% [ %num% ] ,|=|[") ||
+                 Token::Match(tok2, "%type% %var% [ %var% ] ,|=|["))
         {
             tok2 = tok2->tokAt(5);    // The ',' token
+            while (Token::Match(tok2, "[ %num% ]") || Token::Match(tok2, "[ %var% ]"))
+                tok2 = tok2->tokAt(3);
+            if (!Token::Match(tok2, "=|,"))
+            {
+                tok2 = NULL;
+            }
 
-            if (tok2->str() == "=")
+            if (tok2 && tok2->str() == "=")
             {
                 while (tok2 && tok2->str() != ",")
                 {
diff --git a/test/testtokenize.cpp b/test/testtokenize.cpp
index 18a5ab9b2..062a1fad3 100644
--- a/test/testtokenize.cpp
+++ b/test/testtokenize.cpp
@@ -177,6 +177,7 @@ private:
         TEST_CASE(vardecl8);
         TEST_CASE(vardecl9);
         TEST_CASE(vardecl10);
+        TEST_CASE(vardecl11);
         TEST_CASE(vardecl_stl);
         TEST_CASE(vardecl_template);
         TEST_CASE(volatile_variables);
@@ -2794,6 +2795,13 @@ private:
         ASSERT_EQUALS(code, tokenizeAndStringify(code));
     }
 
+    void vardecl11()
+    {
+        // ticket #1684
+        const char code[] = "char a[5][8], b[5][8];";
+        ASSERT_EQUALS("char a [ 5 ] [ 8 ] ; char b [ 5 ] [ 8 ] ;", tokenizeAndStringify(code));
+    }
+
     void volatile_variables()
     {
         const char code[] = "volatile int a=0;\n"