walkero
/
cppcheck
1
0
Fork 0
Code Issues Pull Requests Projects Releases 1 Wiki Activity

#6740 segmentation fault (invalid code) in Tokenizer::simplifyFunctionPointers. Throw syntaxError instead

This commit is contained in:
Alexander Mai 2015-06-02 19:48:20 +02:00
parent a3bdd90df5
commit 7fc9930b38
2 changed files with 10 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
lib/tokenize.cpp
View File

@ -5283,6 +5283,10 @@ void Tokenizer::simplifyFunctionPointers()
tok = tok->next();
// check that the declaration ends
if (!tok || !tok->link() || !tok->link()->next()) {
syntaxError(nullptr);
return;
}
Token *endTok = tok->link()->next()->link();
if (!Token::Match(endTok, ") const| ;|,|)|=|[|{"))
continue;

5
test/testgarbage.cpp
View File

@ -102,6 +102,7 @@ private:
TEST_CASE(garbageCode61);
TEST_CASE(garbageCode62);
TEST_CASE(garbageCode63);
TEST_CASE(garbageCode64);
TEST_CASE(garbageValueFlow);
TEST_CASE(garbageSymbolDatabase);
@ -575,6 +576,10 @@ private:
ASSERT_THROW(checkCode("{ } { } typedef int u_array[]; typedef u_array &u_array_ref; (u_array_ref arg) { } u_array_ref u_array_ref_gbl_obj0"), InternalError);
}
void garbageCode64() { // #6740
ASSERT_THROW(checkCode("{ } foo(void (*bar)(void))"), InternalError);
}
void garbageValueFlow() {
// #6089