From 9bea7bec92f200f8114f106827ac00f4b679bd8b Mon Sep 17 00:00:00 2001 From: Frank Zingsheim Date: Fri, 1 May 2015 18:28:00 +0200 Subject: [PATCH] Fixed #6659 (heap user after free: kernel: sm750_accel.c) --- lib/tokenize.cpp | 4 +++- test/testgarbage.cpp | 2 +- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/lib/tokenize.cpp b/lib/tokenize.cpp index ba0ca8e01..913209890 100644 --- a/lib/tokenize.cpp +++ b/lib/tokenize.cpp @@ -2158,7 +2158,9 @@ static Token *skipTernaryOp(Token *tok) break; } } - if (Token::Match(tok->next(), "[{};]")) + if (tok->link() && Token::Match(tok, "[(<]")) + tok = tok->link(); + else if (Token::Match(tok->next(), "[{};)]")) break; } if (colonlevel) // Ticket #5214: Make sure the ':' matches the proper '?' diff --git a/test/testgarbage.cpp b/test/testgarbage.cpp index 4fa6cdf0c..1bf0d0d51 100644 --- a/test/testgarbage.cpp +++ b/test/testgarbage.cpp @@ -209,7 +209,7 @@ private: ASSERT_THROW(checkCode("void f() {switch (n) { case 0?1;:{2} : z(); break;}}"), InternalError); - ASSERT_THROW(checkCode("void f() {switch (n) { case 0?(1?{3:4}):2 : z(); break;}}"), InternalError); + checkCode("void f() {switch (n) { case 0?(1?{3:4}):2 : z(); break;}}"); //ticket #4234 ASSERT_THROW(checkCode("( ) { switch break ; { switch ( x ) { case } y break ; : } }"), InternalError);