walkero
/
cppcheck
1
0
Fork 0
Code Issues Pull Requests Projects Releases 1 Wiki Activity

#6790 segmentation fault (invalid code) in Tokenizer::simplifyTypedef. Fix null pointer access

This commit is contained in:
Alexander Mai 2015-06-25 07:47:40 +02:00
parent 56b826e3bf
commit c047fae53b
2 changed files with 21 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
lib/tokenize.cpp
View File

@ -954,10 +954,16 @@ void Tokenizer::simplifyTypedef()
typeName = tokOffset->tokAt(-2); typeName = tokOffset->tokAt(-2);
argStart = tokOffset; argStart = tokOffset;
argEnd = tokOffset->link(); argEnd = tokOffset->link();
if (!argEnd) {
syntaxError(arrayStart);
return;
}
argFuncRetStart = argEnd->tokAt(2); argFuncRetStart = argEnd->tokAt(2);
argFuncRetEnd = argFuncRetStart->link(); argFuncRetEnd = argFuncRetStart->link();
if (!argFuncRetEnd) {
syntaxError(argFuncRetStart);
return;
}
tok = argFuncRetEnd->next(); tok = argFuncRetEnd->next();
} }
@ -990,7 +996,10 @@ void Tokenizer::simplifyTypedef()
typeName = tokOffset->tokAt(-2); typeName = tokOffset->tokAt(-2);
argStart = tokOffset; argStart = tokOffset;
argEnd = tokOffset->link(); argEnd = tokOffset->link();
if (!argEnd) {
syntaxError(arrayStart);
return;
}
argFuncRetStart = argEnd->tokAt(2); argFuncRetStart = argEnd->tokAt(2);
if (!argFuncRetStart) { if (!argFuncRetStart) {
syntaxError(tokOffset); syntaxError(tokOffset);
@ -1012,6 +1021,10 @@ void Tokenizer::simplifyTypedef()
typeName = tokOffset; typeName = tokOffset;
arrayStart = tokOffset->tokAt(2); arrayStart = tokOffset->tokAt(2);
arrayEnd = arrayStart->link(); arrayEnd = arrayStart->link();
if (!arrayEnd) {
syntaxError(arrayStart);
return;
}
tok = arrayEnd->next(); tok = arrayEnd->next();
} }

5
test/testgarbage.cpp
View File

@ -129,6 +129,7 @@ private:
TEST_CASE(garbageCode87); TEST_CASE(garbageCode87);
TEST_CASE(garbageCode88); TEST_CASE(garbageCode88);
TEST_CASE(garbageCode89); TEST_CASE(garbageCode89);
TEST_CASE(garbageCode90);
TEST_CASE(garbageValueFlow); TEST_CASE(garbageValueFlow);
TEST_CASE(garbageSymbolDatabase); TEST_CASE(garbageSymbolDatabase);
@ -707,6 +708,10 @@ private:
ASSERT_THROW(checkCode("{ { ( ) } P ( ) ^ { } { } { } ( ) } 0"), InternalError); // do not crash ASSERT_THROW(checkCode("{ { ( ) } P ( ) ^ { } { } { } ( ) } 0"), InternalError); // do not crash
} }
void garbageCode90() { // #6790
ASSERT_THROW(checkCode("{ } { } typedef int u_array [[ ] ; typedef u_array & u_array_ref] ( ) { } u_array_ref_gbl_obj0"), InternalError); // do not crash
}
void garbageValueFlow() { void garbageValueFlow() {
// #6089 // #6089
const char* code = "{} int foo(struct, x1, struct x2, x3, int, x5, x6, x7)\n" const char* code = "{} int foo(struct, x1, struct x2, x3, int, x5, x6, x7)\n"