From 65af02f0cf98af5a9e9751d9203f3ed07dbaac0a Mon Sep 17 00:00:00 2001
From: Paul Fultz II <pfultz2@yahoo.com>
Date: Sat, 6 Jul 2019 03:46:17 -0500
Subject: [PATCH] Fix crash with lambda capture (#1960)

---
 lib/symboldatabase.cpp | 7 ++++++-
 lib/tokenize.cpp       | 2 +-
 test/testtokenize.cpp  | 6 ++++++
 3 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/lib/symboldatabase.cpp b/lib/symboldatabase.cpp
index e321e808e..21779f61f 100644
--- a/lib/symboldatabase.cpp
+++ b/lib/symboldatabase.cpp
@@ -668,7 +668,9 @@ void SymbolDatabase::createSymbolDatabaseFindAllScopes()
                 const Token *lambdaStartToken = lambdaEndToken->link();
                 const Token * argStart = lambdaStartToken->astParent();
                 const Token * funcStart = Token::simpleMatch(argStart, "[") ? argStart : argStart->astParent();
-                addGlobalFunction(scope, tok, argStart, funcStart);
+                const Function * function = addGlobalFunction(scope, tok, argStart, funcStart);
+                if (!function)
+                    mTokenizer->syntaxError(tok);
                 tok = lambdaStartToken;
             } else if (tok->str() == "{") {
                 if (isExecutableScope(tok)) {
@@ -679,6 +681,9 @@ void SymbolDatabase::createSymbolDatabaseFindAllScopes()
                     tok = tok->link();
                 }
             }
+            // syntax error?
+            if (!scope)
+                mTokenizer->syntaxError(tok);
         }
     }
 }
diff --git a/lib/tokenize.cpp b/lib/tokenize.cpp
index 2fd0ca113..de3597a00 100644
--- a/lib/tokenize.cpp
+++ b/lib/tokenize.cpp
@@ -6609,7 +6609,7 @@ void Tokenizer::simplifyVarDecl(Token * tokBegin, const Token * const tokEnd, co
             Token *eq = tok2;
 
             while (tok2) {
-                if (Token::Match(tok2, "{|("))
+                if (Token::Match(tok2, "{|(|["))
                     tok2 = tok2->link();
 
                 else if (!isC() && tok2->str() == "<" && tok2->previous()->isName() && !tok2->previous()->varId())
diff --git a/test/testtokenize.cpp b/test/testtokenize.cpp
index af416693f..b702a008e 100644
--- a/test/testtokenize.cpp
+++ b/test/testtokenize.cpp
@@ -7840,6 +7840,12 @@ private:
         ASSERT_NO_THROW(tokenizeAndStringify("auto f(int& i) { return [&, i] {}; }"))
         ASSERT_NO_THROW(tokenizeAndStringify("auto f(int& i) { return [&, i = std::move(i)] {}; }"))
         ASSERT_NO_THROW(tokenizeAndStringify("auto f(int& i) { return [=, i = std::move(i)] {}; }"))
+        ASSERT_NO_THROW(tokenizeAndStringify("struct c {\n"
+                                             "  void d() {\n"
+                                             "    int a;\n"
+                                             "    auto b = [this, a] {};\n"
+                                             "  }\n"
+                                             "};\n"))
     }
 
     void noCrash1() {