From f1eef49fcb4e73baa2e149b91434ce4ab28856ab Mon Sep 17 00:00:00 2001
From: Robert Reif <reif@earthlink.net>
Date: Tue, 23 Nov 2010 07:31:15 +0100
Subject: [PATCH] Fixed #2221 (segmentation fault of cppcheck)

---
 lib/symboldatabase.cpp | 26 +++++++++++++++++++++-----
 test/testclass.cpp     | 14 ++++++++++++++
 2 files changed, 35 insertions(+), 5 deletions(-)

diff --git a/lib/symboldatabase.cpp b/lib/symboldatabase.cpp
index 65d3faa18..ff81e69bf 100644
--- a/lib/symboldatabase.cpp
+++ b/lib/symboldatabase.cpp
@@ -872,7 +872,7 @@ void SymbolDatabase::SpaceInfo::getVarList()
             if (!tok->isStandardType())
                 isClass = true;
 
-            vartok = tok->tokAt(1);
+            vartok = tok->next();
             tok = vartok->next();
         }
         else if (Token::Match(tok, "%type% :: %type% %var% ;"))
@@ -923,7 +923,7 @@ void SymbolDatabase::SpaceInfo::getVarList()
             if (!tok->isStandardType())
                 isClass = true;
 
-            vartok = tok->tokAt(1);
+            vartok = tok->next();
             tok = vartok->next()->link()->next();
         }
 
@@ -948,6 +948,10 @@ void SymbolDatabase::SpaceInfo::getVarList()
         else if (Token::Match(tok, "%type% :: %type% <") ||
                  Token::Match(tok, "%type% <"))
         {
+            // got an unhandled template?
+            if (tok->str() == "template")
+                continue;
+
             // find matching ">"
             int level = 0;
             for (; tok; tok = tok->next())
@@ -960,14 +964,26 @@ void SymbolDatabase::SpaceInfo::getVarList()
                     if (level == 0)
                         break;
                 }
+                else if (tok->str() == ">>")
+                {
+                    level-=2;
+                    if (level <= 0)
+                        break;
+                }
+                else if (tok->str() == "(")
+                    tok = tok->link();
+
+                // don't crash on unhandled templates
+                if (tok->next() == NULL)
+                    break;
             }
-            if (tok && Token::Match(tok, "> %var% ;"))
+            if (tok && (Token::Match(tok, "> %var% ;") || Token::Match(tok, ">> %var% ;")))
             {
                 isClass = true;
-                vartok = tok->tokAt(1);
+                vartok = tok->next();
                 tok = vartok->next();
             }
-            else if (tok && Token::Match(tok, "> * %var% ;"))
+            else if (tok && (Token::Match(tok, "> * %var% ;") || Token::Match(tok, ">> * %var% ;")))
             {
                 vartok = tok->tokAt(2);
                 tok = vartok->next();
diff --git a/test/testclass.cpp b/test/testclass.cpp
index fc1b88eb0..82ba5e106 100644
--- a/test/testclass.cpp
+++ b/test/testclass.cpp
@@ -169,6 +169,7 @@ private:
         TEST_CASE(symboldatabase3); // ticket #2000
         TEST_CASE(symboldatabase4);
         TEST_CASE(symboldatabase5); // ticket #2178
+        TEST_CASE(symboldatabase6); // ticket #2221
     }
 
     // Check the operator Equal
@@ -4827,6 +4828,19 @@ private:
                    "}\n");
         ASSERT_EQUALS("", errout.str());
     }
+
+    void symboldatabase6()
+    {
+        // ticket #2221 - segmentation fault
+        checkConst("template<int i> class X { };\n"
+                   "X< 1>2 > x1;\n"
+                   "X<(1>2)> x2;\n"
+                   "template<class T> class Y { };\n"
+                   "Y<X<1>> x3;\n"
+                   "Y<X<6>>1>> x4;\n"
+                   "Y<X<(6>>1)>> x5;\n");
+        ASSERT_EQUALS("", errout.str());
+    }
 };
 
 REGISTER_TEST(TestClass)