Fix #13493 fuzzing crash (stack overflow) in CheckNullPointer::nullPo…

…interByDeRefAndCheck() (#7160)
danmar · Jan 2, 2025 · 7a40fbc · 7a40fbc
1 parent 5bbde51
commit 7a40fbc
Show file tree

Hide file tree

Showing 4 changed files with 7 additions and 4 deletions.
diff --git a/lib/tokenize.cpp b/lib/tokenize.cpp
@@ -8765,6 +8765,8 @@ void Tokenizer::findGarbageCode() const
         }
         if (Token::Match(tok, "[{,] . %name%") && !Token::Match(tok->tokAt(3), "[.=[{]"))
             syntaxError(tok->next());
+        if (Token::Match(tok, "%name% %op% %name%") && !tok->isKeyword() && tok->next()->isIncDecOp())
+            syntaxError(tok->next());
         if (Token::Match(tok, "[!|+-/%^~] )|]"))
             syntaxError(tok);
         if (Token::Match(tok, "==|!=|<=|>= %comp%") && tok->strAt(-1) != "operator")

diff --git a/test/cli/fuzz-crash_c/crash-85219ec46607233cec457b54a209ded59c333f46 b/test/cli/fuzz-crash_c/crash-85219ec46607233cec457b54a209ded59c333f46
@@ -0,0 +1 @@
+n(){o?5:t++m}
diff --git a/test/testother.cpp b/test/testother.cpp
@@ -5111,7 +5111,7 @@ class TestOther : public TestFixture {
               "    {\n"
               "    case 2:\n"
               "        y |= z;\n"
-              "        z++\n"
+              "        z++;\n"
               "    default:\n"
               "        y |= z;\n"
               "        break;\n"

diff --git a/test/teststl.cpp b/test/teststl.cpp
@@ -1386,7 +1386,7 @@ class TestStl : public TestFixture {
               "    std::vector<int>::const_iterator it;\n"
               "    it = a.begin();\n"
               "    while (it!=a.end())\n"
-              "        v++it;\n"
+              "        ++it;\n"
               "    it = t.begin();\n"
               "    while (it!=t.end())\n"
               "        ++it;\n"
@@ -1402,9 +1402,9 @@ class TestStl : public TestFixture {
               "    else\n"
               "        it = t.begin();\n"
               "    while (z && it!=a.end())\n"
-              "        v++it;\n"
+              "        ++it;\n"
               "    while (!z && it!=t.end())\n"
-              "        v++it;\n"
+              "        ++it;\n"
               "}");
         ASSERT_EQUALS("", errout_str());
     }