Fix #12864, #12865 fuzzing crashes (#6547)

danmar · Jun 26, 2024 · 096174a · 096174a
1 parent 1668b0b
commit 096174a
Show file tree

Hide file tree

Showing 3 changed files with 9 additions and 0 deletions.
diff --git a/lib/tokenize.cpp b/lib/tokenize.cpp
@@ -910,6 +910,9 @@ namespace {
 
             Token* const tok4 = useAfterVarRange ? insertTokens(after->previous(), mRangeAfterVar)->next() : tok3->next();
 
+            if (tok->next() == tok4)
+                throw InternalError(tok, "Failed to simplify typedef. Is the code valid?");
+
             tok->deleteThis();
 
             // Unsplit variable declarations
@@ -8695,6 +8698,10 @@ void Tokenizer::findGarbageCode() const
         }
         if (Token::Match(tok, "%num%|%bool%|%char%|%str% %num%|%bool%|%char%|%str%") && !Token::Match(tok, "%str% %str%"))
             syntaxError(tok);
+        if (Token::Match(tok, "%num%|%bool%|%char%|%str% {") &&
+            !(tok->tokType() == Token::Type::eString && Token::simpleMatch(tok->tokAt(-1), "extern")) &&
+            !(tok->tokType() == Token::Type::eBoolean && cpp && Token::simpleMatch(tok->tokAt(-1), "requires")))
+            syntaxError(tok);
         if (Token::Match(tok, "%assign% typename|class %assign%"))
             syntaxError(tok);
         if (Token::Match(tok, "%assign% [;)}]") && (!cpp || !Token::simpleMatch(tok->previous(), "operator")))

diff --git a/test/cli/fuzz-crash/crash-c021b973c9f8692ff1ea73710209a4129dc7a834 b/test/cli/fuzz-crash/crash-c021b973c9f8692ff1ea73710209a4129dc7a834
@@ -0,0 +1 @@
+typedef const C;C(public C<i)
diff --git a/test/cli/fuzz-crash/crash-f158d32510f6eba5e1aa06ed8ef689b88da33a95 b/test/cli/fuzz-crash/crash-f158d32510f6eba5e1aa06ed8ef689b88da33a95
@@ -0,0 +1 @@
+enum{a=1{}=d};