walkero
/
cppcheck
1
0
Fork 0
Code Issues Pull Requests Projects Releases 1 Wiki Activity

#6749 segmentation fault (invalid code) in Tokenizer::copyTokens. #6750 segmentation fault (invalid code) in Tokenizer::simplifyTypedef.

This commit is contained in:
amai2012 2015-06-03 10:39:19 +02:00
parent d36c84553f
commit ed5a4127e8
2 changed files with 30 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
lib/tokenize.cpp
View File

@ -1349,11 +1349,18 @@ void Tokenizer::simplifyTypedef()
tok2 = tok2->next(); tok2 = tok2->next();
Token::createMutualLinks(tok2, tok3); Token::createMutualLinks(tok2, tok3);
} }
if (!tok2) {
syntaxError(nullptr);
return;
}
tok2 = copyTokens(tok2, argStart, argEnd); tok2 = copyTokens(tok2, argStart, argEnd);
if (inTemplate) {
if (inTemplate) if (!tok2) {
syntaxError(nullptr);
return;
}
tok2 = tok2->next(); tok2 = tok2->next();
}
if (specStart) { if (specStart) {
Token *spec = specStart; Token *spec = specStart;
@ -1372,7 +1379,7 @@ void Tokenizer::simplifyTypedef()
tok2->insertToken("*"); tok2->insertToken("*");
tok2 = tok2->next(); tok2 = tok2->next();
Token * tok4 = 0; Token * tok4 = nullptr;
if (functionPtrRetFuncPtr) { if (functionPtrRetFuncPtr) {
tok2->insertToken("("); tok2->insertToken("(");
tok2 = tok2->next(); tok2 = tok2->next();
@ -1486,7 +1493,10 @@ void Tokenizer::simplifyTypedef()
tok2 = tok2->tokAt(2); tok2 = tok2->tokAt(2);
else else
tok2 = tok2->tokAt(3); tok2 = tok2->tokAt(3);
if (!tok2) {
syntaxError(nullptr);
return;
}
tok2->insertToken(")"); tok2->insertToken(")");
tok2 = tok2->next(); tok2 = tok2->next();
Token::createMutualLinks(tok2, tok3); Token::createMutualLinks(tok2, tok3);
@ -1498,8 +1508,10 @@ void Tokenizer::simplifyTypedef()
} }
tok2 = copyTokens(tok2, arrayStart, arrayEnd); tok2 = copyTokens(tok2, arrayStart, arrayEnd);
if (!tok2->next()) if (!tok2->next()) {
syntaxError(tok2); syntaxError(tok2);
return;
}
tok2 = tok2->next(); tok2 = tok2->next();
if (tok2->str() == "=") { if (tok2->str() == "=") {
@ -1520,8 +1532,8 @@ void Tokenizer::simplifyTypedef()
if (tok->str() == ";") if (tok->str() == ";")
done = true; done = true;
else if (tok->str() == ",") { else if (tok->str() == ",") {
arrayStart = 0; arrayStart = nullptr;
arrayEnd = 0; arrayEnd = nullptr;
tokOffset = tok->next(); tokOffset = tok->next();
pointers.clear(); pointers.clear();

10
test/testgarbage.cpp
View File

@ -110,6 +110,8 @@ private:
TEST_CASE(garbageCode69); TEST_CASE(garbageCode69);
TEST_CASE(garbageCode70); TEST_CASE(garbageCode70);
TEST_CASE(garbageCode71); TEST_CASE(garbageCode71);
TEST_CASE(garbageCode72);
TEST_CASE(garbageCode73);
TEST_CASE(garbageValueFlow); TEST_CASE(garbageValueFlow);
TEST_CASE(garbageSymbolDatabase); TEST_CASE(garbageSymbolDatabase);
@ -615,6 +617,14 @@ private:
ASSERT_THROW(checkCode("( ) { } typedef void noattr_t ( ) ; noattr_t __attribute__ ( )"), InternalError); ASSERT_THROW(checkCode("( ) { } typedef void noattr_t ( ) ; noattr_t __attribute__ ( )"), InternalError);
} }
void garbageCode72() { // #6749
ASSERT_THROW(checkCode("{ } { } typedef void voidfn(void); <voidfn&"), InternalError);
}
void garbageCode73() { // #6750
ASSERT_THROW(checkCode("typedef int IRT[2]; IRT&"), InternalError);
}
void garbageValueFlow() { void garbageValueFlow() {
// #6089 // #6089
const char* code = "{} int foo(struct, x1, struct x2, x3, int, x5, x6, x7)\n" const char* code = "{} int foo(struct, x1, struct x2, x3, int, x5, x6, x7)\n"