From cee0f724ff1197d4a5fc0c06cb4e9c563f724e5d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matthias=20Kr=C3=BCger?= <matthias.krueger@famsik.de>
Date: Mon, 1 May 2017 14:10:06 +0200
Subject: [PATCH] Fixed #8018: Tokenize::findGarbageCode: detect heads of
 for-loops with 1 or more than 2 semicolons as garbage code.

---
 lib/tokenize.cpp     | 21 +++++++++++++++++++++
 test/testgarbage.cpp |  5 +++--
 2 files changed, 24 insertions(+), 2 deletions(-)

diff --git a/lib/tokenize.cpp b/lib/tokenize.cpp
index 3c81aa46c..23109f429 100644
--- a/lib/tokenize.cpp
+++ b/lib/tokenize.cpp
@@ -8133,6 +8133,27 @@ const Token * Tokenizer::findGarbageCode() const
         }
     }
 
+    for (const Token *tok = tokens(); tok ; tok = tok->next()) {
+        if (!Token::simpleMatch(tok, "for (")) // find for loops
+            continue;
+        // count number of semicolons
+        unsigned int semicolons = 0;
+        const Token* const startTok = tok;
+        tok = tok->next()->link()->previous(); // find ")" of the for-loop
+        // walk backwards until we find the beginning (startTok) of the for() again
+        for (; tok != startTok; tok = tok->previous()) {
+            if (tok->str() == ";") { // do the counting
+                semicolons++;
+            } else if (tok->str() == ")") { // skip pairs of ( )
+                tok = tok->link();
+            }
+        }
+        // if we have an invalid number of semicolons inside for( ), assume syntax error
+        if ((semicolons == 1) || (semicolons > 2)) {
+            return tok;
+        }
+    }
+
     // Code must not start with an arithmetical operand
     if (Token::Match(list.front(), "%cop%"))
         return list.front();
diff --git a/test/testgarbage.cpp b/test/testgarbage.cpp
index c76f05cf7..361532139 100644
--- a/test/testgarbage.cpp
+++ b/test/testgarbage.cpp
@@ -1035,7 +1035,8 @@ private:
     }
 
     void garbageCode136() { // #7033
-        checkCode("{ } () { void f() { node_t * n; for (; -n) {} } } { }");
+        ASSERT_THROW(checkCode("{ } () { void f() { node_t * n; for (; -n) {} } } { }"),
+                     InternalError);
     }
 
     void garbageCode137() { // #7034
@@ -1326,7 +1327,7 @@ private:
 
     void garbageCode165() {
         //7235
-        checkCode("for(;..)", false);
+        ASSERT_THROW(checkCode("for(;..)", false),InternalError);
     }
 
     void garbageCode167() {