diff --git a/lib/tokenize.cpp b/lib/tokenize.cpp index 0fc1efaeb..2465f121e 100755 --- a/lib/tokenize.cpp +++ b/lib/tokenize.cpp @@ -97,7 +97,7 @@ const Token * Tokenizer::isFunctionHead(const Token *tok, const std::string &end tok = tok->next(); if (tok->str() == ")") tok = tok->next(); - while (tok && tok->str() == "[") + while (tok && tok->str() == "[" && tok->link()) tok = tok->link()->next(); return (tok && endsWith.find(tok->str()) != std::string::npos) ? tok : nullptr; } diff --git a/test/testgarbage.cpp b/test/testgarbage.cpp index e37483d66..ed809834c 100644 --- a/test/testgarbage.cpp +++ b/test/testgarbage.cpp @@ -222,6 +222,7 @@ private: TEST_CASE(garbageCode189); // #8317 TEST_CASE(garbageCode190); // #8307 TEST_CASE(garbageCode191); // #8333 + TEST_CASE(garbageCode192); // #8386 (segmentation fault) TEST_CASE(garbageCodeFuzzerClientMode1); // test cases created with the fuzzer client, mode 1 @@ -1475,6 +1476,10 @@ private: checkCode("struct A { int f ( char ) ; } ;"); } + void garbageCode192() { // #8386 (segmentation fault) + ASSERT_THROW(checkCode("{(()[((0||0xf||))]0[])}"), InternalError); + } + void syntaxErrorFirstToken() { ASSERT_THROW(checkCode("&operator(){[]};"), InternalError); // #7818 ASSERT_THROW(checkCode("*(*const<> (size_t); foo) { } *(*const (size_t)() ; foo) { }"), InternalError); // #6858