From 42593493c18a2947d446f94a6da50a17a5f714b0 Mon Sep 17 00:00:00 2001 From: chrchr-github Date: Sun, 29 Sep 2024 23:14:20 +0200 Subject: [PATCH 1/2] Fix #12888 fuzzing crash in getEnumType() --- lib/tokenize.cpp | 9 ++++++--- .../crash-1bcbece2593792b0d34fb8f5dbacbae22decd082 | 1 + 2 files changed, 7 insertions(+), 3 deletions(-) create mode 100644 test/cli/fuzz-crash/crash-1bcbece2593792b0d34fb8f5dbacbae22decd082 diff --git a/lib/tokenize.cpp b/lib/tokenize.cpp index 00e48ab0c9c..2be929bbfad 100644 --- a/lib/tokenize.cpp +++ b/lib/tokenize.cpp @@ -8731,10 +8731,13 @@ void Tokenizer::findGarbageCode() const } if (Token::Match(tok, "%num%|%bool%|%char%|%str% %num%|%bool%|%char%|%str%") && !Token::Match(tok, "%str% %str%")) syntaxError(tok); - if (Token::Match(tok, "%num%|%bool%|%char%|%str% {") && - !(tok->tokType() == Token::Type::eString && Token::simpleMatch(tok->tokAt(-1), "extern")) && - !(tok->tokType() == Token::Type::eBoolean && cpp && Token::simpleMatch(tok->tokAt(-1), "requires"))) + if (Token::Match(tok, "%num%|%bool%|%char%|%str% {|(")) { + if (tok->strAt(1) == "(") + syntaxError(tok); + else if (!(tok->tokType() == Token::Type::eString && Token::simpleMatch(tok->tokAt(-1), "extern")) && + !(tok->tokType() == Token::Type::eBoolean && cpp && Token::simpleMatch(tok->tokAt(-1), "requires"))) syntaxError(tok); + } if (Token::Match(tok, "%assign% typename|class %assign%")) syntaxError(tok); if (Token::Match(tok, "%assign% [;)}]") && (!cpp || !Token::simpleMatch(tok->previous(), "operator"))) diff --git a/test/cli/fuzz-crash/crash-1bcbece2593792b0d34fb8f5dbacbae22decd082 b/test/cli/fuzz-crash/crash-1bcbece2593792b0d34fb8f5dbacbae22decd082 new file mode 100644 index 00000000000..c95fb490043 --- /dev/null +++ b/test/cli/fuzz-crash/crash-1bcbece2593792b0d34fb8f5dbacbae22decd082 @@ -0,0 +1 @@ +enum{A=0()7=F}; \ No newline at end of file From 83f85112549f7ac89a92b408669b100098cc900b Mon Sep 17 00:00:00 2001 From: chrchr-github Date: Sun, 29 Sep 2024 23:16:44 +0200 Subject: [PATCH 2/2] Format --- lib/tokenize.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/tokenize.cpp b/lib/tokenize.cpp index 2be929bbfad..a18b5361bec 100644 --- a/lib/tokenize.cpp +++ b/lib/tokenize.cpp @@ -8736,7 +8736,7 @@ void Tokenizer::findGarbageCode() const syntaxError(tok); else if (!(tok->tokType() == Token::Type::eString && Token::simpleMatch(tok->tokAt(-1), "extern")) && !(tok->tokType() == Token::Type::eBoolean && cpp && Token::simpleMatch(tok->tokAt(-1), "requires"))) - syntaxError(tok); + syntaxError(tok); } if (Token::Match(tok, "%assign% typename|class %assign%")) syntaxError(tok);