From 8946fcd9607171e7507afd94fa63e2241d88b90c Mon Sep 17 00:00:00 2001
From: Alexander Mai <amai@users.sf.net>
Date: Wed, 24 Jun 2015 20:47:04 +0200
Subject: [PATCH] #6772 segmentation fault (invalid code) in
 Tokenizer::setVarId. Add another validate() call to
 Tokenizer::simplifyTokenList1. Small refactoring to Tokenizer: mark many
 methods as private.

---
 lib/tokenize.cpp     |  2 ++
 lib/tokenize.h       | 14 ++++++++++++++
 test/testgarbage.cpp |  5 +++++
 3 files changed, 21 insertions(+)

diff --git a/lib/tokenize.cpp b/lib/tokenize.cpp
index cc7f7a277..3a5222112 100644
--- a/lib/tokenize.cpp
+++ b/lib/tokenize.cpp
@@ -3574,6 +3574,8 @@ bool Tokenizer::simplifyTokenList1(const char FileName[])
     // Split up variable declarations.
     simplifyVarDecl(false);
 
+    validate(); // #6772 "segmentation fault (invalid code) in Tokenizer::setVarId"
+
     if (m_timerResults) {
         Timer t("Tokenizer::tokenize::setVarId", _settings->_showtime, m_timerResults);
         setVarId();
diff --git a/lib/tokenize.h b/lib/tokenize.h
index 755805cd9..14433981e 100644
--- a/lib/tokenize.h
+++ b/lib/tokenize.h
@@ -40,6 +40,10 @@ class TimerResults;
 
 /** @brief The main purpose is to tokenize the source code. It also has functions that simplify the token list */
 class CPPCHECKLIB Tokenizer {
+
+    friend class TestSimplifyTokens;
+    friend class TestSimplifyTypedef;
+    friend class TestTokenizer;
 public:
     Tokenizer();
     Tokenizer(const Settings * settings, ErrorLogger *errorLogger);
@@ -528,6 +532,8 @@ public:
      */
     static std::string simplifyString(const std::string &source);
 
+private:
+
     /**
      * Change "int const x;" into "const int x;"
      */
@@ -586,12 +592,16 @@ public:
      */
     void createLinks2();
 
+public:
+
     /** Syntax error */
     void syntaxError(const Token *tok) const;
 
     /** Syntax error. Example: invalid number of ')' */
     void syntaxError(const Token *tok, char c) const;
 
+private:
+
     /** Report that there is an unhandled "class x y {" code */
     void unhandled_macro_class_x_y(const Token *tok) const;
 
@@ -729,11 +739,14 @@ public:
 
     void unsupportedTypedef(const Token *tok) const;
 
+public:
+
     /** Was there templates in the code? */
     bool codeWithTemplates() const {
         return _codeWithTemplates;
     }
 
+
     void setSettings(const Settings *settings) {
         _settings = settings;
         list.setSettings(settings);
@@ -759,6 +772,7 @@ public:
         return _varId;
     }
 
+
     /**
      * Simplify e.g. 'return(strncat(temp,"a",1));' into
      * strncat(temp,"a",1); return temp;
diff --git a/test/testgarbage.cpp b/test/testgarbage.cpp
index 6dda2a9f5..2e3d94ee9 100644
--- a/test/testgarbage.cpp
+++ b/test/testgarbage.cpp
@@ -128,6 +128,7 @@ private:
         TEST_CASE(garbageCode86);
         TEST_CASE(garbageCode87);
         TEST_CASE(garbageCode88);
+        TEST_CASE(garbageCode89);
 
         TEST_CASE(garbageValueFlow);
         TEST_CASE(garbageSymbolDatabase);
@@ -702,6 +703,10 @@ private:
         ASSERT_THROW(checkCode("( ) { ( 0 ) { ( ) } } g ( ) { i( ( false ?) ( ) : 1 ) ; } ;"), InternalError); // do not crash
     }
 
+    void garbageCode89() { // #6772
+        ASSERT_THROW(checkCode("{ { ( ) } P ( ) ^ { } { } { } ( ) } 0"), InternalError); // do not crash
+    }
+
     void garbageValueFlow() {
         // #6089
         const char* code = "{} int foo(struct, x1, struct x2, x3, int, x5, x6, x7)\n"