Fix #12702 fuzzing crash in TemplateSimplifier::useDefaultArgumentVal…

…ues (danmar#6387)
chrchr-github · May 10, 2024 · 37dc795 · 37dc795
1 parent 89f5657
commit 37dc795
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 0 deletions.
diff --git a/lib/tokenize.cpp b/lib/tokenize.cpp
@@ -8766,6 +8766,8 @@ void Tokenizer::findGarbageCode() const
     // Garbage templates..
     if (isCPP()) {
         for (const Token *tok = tokens(); tok; tok = tok->next()) {
+            if (Token::simpleMatch(tok, "< >") && !(Token::Match(tok->tokAt(-1), "%name%") || (tok->tokAt(-1) && Token::Match(tok->tokAt(-2), "operator %op%"))))
+                syntaxError(tok);
             if (!Token::simpleMatch(tok, "template <"))
                 continue;
             if (tok->previous() && !Token::Match(tok->previous(), ":|;|{|}|)|>|\"C++\"")) {

diff --git a/test/cli/fuzz-crash/crash-adb20a108c3686d79bc9bd0e4025445e3a35fa49.crdownload b/test/cli/fuzz-crash/crash-adb20a108c3686d79bc9bd0e4025445e3a35fa49.crdownload
@@ -0,0 +1 @@
+template<#p<>tu< <>tu=e