Fix #12652, #12654 fuzzing crashes (#6344)

danmar · Apr 26, 2024 · 7a3a43b · 7a3a43b
1 parent e5659cc
commit 7a3a43b
Show file tree

Hide file tree

Showing 3 changed files with 5 additions and 1 deletion.
diff --git a/lib/tokenize.cpp b/lib/tokenize.cpp
@@ -4352,7 +4352,7 @@ static void setVarIdStructMembers(Token *&tok1,
 
     while (Token::Match(tok->next(), ")| . %name% !!(")) {
         // Don't set varid for trailing return type
-        if (tok->strAt(1) == ")" && (tok->linkAt(1)->previous()->isName() || tok->linkAt(1)->strAt(-1) == "]") &&
+        if (tok->strAt(1) == ")" && Token::Match(tok->linkAt(1)->tokAt(-1), "%name%|]") &&
             Tokenizer::isFunctionHead(tok->linkAt(1), "{|;")) {
             tok = tok->tokAt(3);
             continue;
@@ -10610,6 +10610,8 @@ void Tokenizer::simplifyNamespaceAliases()
         else if (Token::Match(tok, "namespace %name% =") || (isPrev = Token::Match(tok->previous(), "namespace %name% ="))) {
             if (isPrev)
                 tok = tok->previous();
+            if (tok->tokAt(-1) && !Token::Match(tok->tokAt(-1), "[;{}]"))
+                syntaxError(tok->tokAt(-1));
             const std::string name(tok->next()->str());
             Token * tokNameStart = tok->tokAt(3);
             Token * tokNameEnd = tokNameStart;

diff --git a/test/cli/fuzz-crash/crash-1b9524a7fa25529c34c06b04372efd44e72ccfdc b/test/cli/fuzz-crash/crash-1b9524a7fa25529c34c06b04372efd44e72ccfdc
@@ -0,0 +1 @@
+(h l).h
diff --git a/test/cli/fuzz-crash/crash-2adde1da09b2db453c18898785b78024adb02c78 b/test/cli/fuzz-crash/crash-2adde1da09b2db453c18898785b78024adb02c78
@@ -0,0 +1 @@
+S namespace d=S;e namespace d=a