Fix #12702 fuzzing crash in TemplateSimplifier::useDefaultArgumentValues

danmar · May 6, 2024 · 806d438 · 806d438
1 parent 50be22d
commit 806d438
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 0 deletions.
diff --git a/lib/tokenize.cpp b/lib/tokenize.cpp
@@ -8766,6 +8766,8 @@ void Tokenizer::findGarbageCode() const
     // Garbage templates..
     if (isCPP()) {
         for (const Token *tok = tokens(); tok; tok = tok->next()) {
+            if (Token::simpleMatch(tok, "< >") && !(Token::Match(tok->tokAt(-1), "%name%") || (tok->tokAt(-1) && Token::Match(tok->tokAt(-2), "operator %op%"))))
+                syntaxError(tok);
             if (!Token::simpleMatch(tok, "template <"))
                 continue;
             if (tok->previous() && !Token::Match(tok->previous(), ":|;|{|}|)|>|\"C++\"")) {

diff --git a/test/cli/fuzz-crash/crash-adb20a108c3686d79bc9bd0e4025445e3a35fa49.crdownload b/test/cli/fuzz-crash/crash-adb20a108c3686d79bc9bd0e4025445e3a35fa49.crdownload
@@ -0,0 +1 @@
+template<#p<>tu< <>tu=e