walkero
/
cppcheck
1
0
Fork 0
Code Issues Pull Requests Projects Releases 1 Wiki Activity

Fixed #8154 (heap use after free in tokenlist)

This commit is contained in:
Heiko Eißfeldt 2017-08-25 17:17:19 +02:00 committed by Daniel Marjamäki
parent 50636f75ba
commit bab2b26d10
2 changed files with 8 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
lib/token.cpp
View File

@ -190,6 +190,11 @@ void Token::deleteNext(unsigned long index)
{ {
while (_next && index) { while (_next && index) {
Token *n = _next; Token *n = _next;
// #8154 we are about to be unknown -> destroy the link to us
if (n->_link && n->_link->_link == n)
n->_link->link(nullptr);
_next = n->next(); _next = n->next();
delete n; delete n;
--index; --index;
@ -254,6 +259,8 @@ void Token::deleteThis()
if (_link) if (_link)
_link->link(this); _link->link(this);
_next->link(nullptr); // mark as unlinked
deleteNext(); deleteNext();
} else if (_previous && _previous->_previous) { // Copy previous to this and delete previous } else if (_previous && _previous->_previous) { // Copy previous to this and delete previous
_str = _previous->_str; _str = _previous->_str;

2
test/testgarbage.cpp
View File

@ -310,7 +310,7 @@ private:
} catch (InternalError& e) { } catch (InternalError& e) {
ASSERT_EQUALS("Analysis failed. If the code is valid then please report this failure.", e.errorMessage); ASSERT_EQUALS("Analysis failed. If the code is valid then please report this failure.", e.errorMessage);
ASSERT_EQUALS("cppcheckError", e.id); ASSERT_EQUALS("cppcheckError", e.id);
ASSERT_EQUALS(5, e.token->linenr()); ASSERT_EQUALS(4, e.token->linenr());
} }
} }