Skip to content

Fix fuzzing crash: reject semicolon within parentheses #6197

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
orbitcowboy merged 6 commits into from
Mar 29, 2024
Merged

Fix fuzzing crash: reject semicolon within parentheses #6197

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
74cdab6
Fix fuzzing crash: reject semicolon within parentheses
chrchr-github Mar 27, 2024
488f14b
Fix
chrchr-github Mar 27, 2024
1f35985
Fix
chrchr-github Mar 27, 2024
df12d00
Format
chrchr-github Mar 27, 2024
915bf0f
unknownMacro
chrchr-github Mar 27, 2024
624bcd0
Fix
chrchr-github Mar 27, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 14 additions & 0 deletions lib/tokenize.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8646,6 +8646,20 @@ void Tokenizer::findGarbageCode() const
syntaxError(tok);
if (Token::Match(tok, "& %comp%|&&|%oror%|&|%or%") && tok->strAt(1) != ">")
syntaxError(tok);

if (tok->link() && Token::Match(tok, "[([]") && (!tok->tokAt(-1) || !tok->tokAt(-1)->isControlFlowKeyword())) {
const Token* const end = tok->link();
for (const Token* inner = tok->next(); inner != end; inner = inner->next()) {
if (inner->str() == "{")
inner = inner->link();
else if (inner->str() == ";") {
if (tok->tokAt(-1) && tok->tokAt(-1)->isUpperCaseName())
unknownMacroError(tok->tokAt(-1));
else
syntaxError(inner);
}
}
}
}

// ternary operator without :
Expand Down
1 change: 1 addition & 0 deletions test/cli/fuzz-crash/crash-6eadb507c9ee93d9500028a9be2d183d1518f26b
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
i a;u n(;a[]),n(){a[]=0}
2 changes: 1 addition & 1 deletion test/testgarbage.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -460,7 +460,7 @@ class TestGarbage : public TestFixture {
}

void garbageCode5() { // #5168
checkCode("( asm : ; void : );");
ASSERT_THROW(checkCode("( asm : ; void : );"), InternalError);
}

void garbageCode6() { // #5214
Expand Down
3 changes: 1 addition & 2 deletions test/testsimplifytypedef.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2511,8 +2511,7 @@ class TestSimplifyTypedef : public TestFixture {

void simplifyTypedef105() { // ticket #3616 (segmentation fault)
const char code[] = "( int typedef char x; ){}";
tok(code);
ASSERT_EQUALS("", errout_str());
ASSERT_THROW(tok(code), InternalError);
}

void simplifyTypedef106() { // ticket #3619 (segmentation fault)
Expand Down
2 changes: 1 addition & 1 deletion test/testsymboldatabase.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2530,7 +2530,7 @@ class TestSymbolDatabase : public TestFixture {
"static const std::string j;\n"
"const std::string* k;\n"
"const char m[];\n"
"void f(const char* const l;) {}");
"void f(const char* const l) {}");

ASSERT(db && db->variableList().size() == 6 && db->getVariableFromVarId(1) && db->getVariableFromVarId(2) && db->getVariableFromVarId(3) && db->getVariableFromVarId(4) && db->getVariableFromVarId(5));

Expand Down
9 changes: 5 additions & 4 deletions test/testtokenize.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3692,10 +3692,10 @@ class TestTokenizer : public TestFixture {
void simplifyFunctionPointers3() {
// Related with ticket #2873
const char code[] = "void f() {\n"
"(void)(xy(*p)(0);)"
"(void)(xy(*p)(0));"
"\n}";
const char expected[] = "void f ( ) {\n"
"( void ) ( xy ( * p ) ( 0 ) ; )\n"
"( void ) ( xy ( * p ) ( 0 ) ) ;\n"
"}";
ASSERT_EQUALS(expected, tokenizeAndStringify(code));
}
Expand Down Expand Up @@ -7589,8 +7589,9 @@ class TestTokenizer : public TestFixture {
}

void checkConfiguration() {
ASSERT_THROW(checkConfig("void f() { DEBUG(x();y()); }"), InternalError);
ASSERT_EQUALS("[test.cpp:1]: (information) Ensure that 'DEBUG' is defined either using -I, --include or -D.\n", errout_str());
ASSERT_THROW_EQUALS(checkConfig("void f() { DEBUG(x();y()); }"),
InternalError,
"There is an unknown macro here somewhere. Configuration is required. If DEBUG is a macro then please configure it.");
}

void unknownType() { // #8952
Expand Down