tokenize.cpp: fixed fuzzing crash in setScopeInfo()

[firewave]

No description provided.

[chrchr-github]

I think = must always have both operands, so we should add this to the AST validation.

[chrchr-github]

Unfortuantely, at least these cases would require special handling though:

auto f() { [=]() { return data; }(); }

class A {
    virtual void pure()=0;
};

[firewave]

So we leave it as is?

[chrchr-github]

New idea: reject = followed by ; and possibly )|} as garbage?

[firewave]

Do not ask me. There's a reason I usually do not get involved into the check related stuff...

[chrchr-github]

IMHO we should fail early and hard on invalid code. Random nullptr checks here and there probably just enable the next crash down the line.

[firewave]

I split this into #6162.

[chrchr-github]

There is a check for unlinked )|} somewhere, so I wonder why it doesn't fire.

[chrchr-github]

deleteInvalidTypedef() messes up the links since it runs after createLinks(). Maybeif (!tokOffset || tokOffset->isKeyword()) syntaxError(tok); at tokenize.cpp:1257 is an option.

[firewave]

The issue does not appear to be fully fixed by my change. Will look into that first and then look into your comment.

[firewave]

This required a few more checks down the line.

[chrchr-github]

Maybeif (!tokOffset || tokOffset->isKeyword()) syntaxError(tok); at tokenize.cpp:1257 is an option.

isControlFlowKeyword() seems to work.

[firewave]

What line is that now? Or do you want to take over in a new PR?

[chrchr-github]

tokenize.cpp:1257 is still correct (// check for invalid input),

[firewave]

That is line 1255 in my tree...but that works.

[firewave]

With Clang I know get a segmentation fault even with ASAN and UBSAN enabled. Using GCC I get

/home/user/CLionProjects/cppcheck/lib/tokenize.cpp:2539:52: runtime error: member call on null pointer of type 'struct Token'
    #0 0x636010e8b660 in setScopeInfo /home/user/CLionProjects/cppcheck/lib/tokenize.cpp:2539
    #1 0x636010e939ff in Tokenizer::simplifyUsing() /home/user/CLionProjects/cppcheck/lib/tokenize.cpp:2902
    #2 0x636010eccf0a in Tokenizer::simplifyTokenList1(char const*) /home/user/CLionProjects/cppcheck/lib/tokenize.cpp:5676
    #3 0x636010e9bc65 in Tokenizer::simplifyTokens1(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) /home/user/CLionProjects/cppcheck/lib/tokenize.cpp:3373
    #4 0x636011c46462 in CppCheck::checkFile(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::istream*) /home/user/CLionProjects/cppcheck/lib/cppcheck.cpp:930
    #5 0x636011c3361e in CppCheck::check(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) /home/user/CLionProjects/cppcheck/lib/cppcheck.cpp:563
    #6 0x6360108cd0fd in SingleExecutor::check() /home/user/CLionProjects/cppcheck/cli/singleexecutor.cpp:53
    #7 0x63601079fbad in CppCheckExecutor::check_internal(Settings const&) const /home/user/CLionProjects/cppcheck/cli/cppcheckexecutor.cpp:279
    #8 0x63601079d34f in CppCheckExecutor::check_wrapper(Settings const&) /home/user/CLionProjects/cppcheck/cli/cppcheckexecutor.cpp:218
    #9 0x63601079cfa3 in CppCheckExecutor::check(int, char const* const*) /home/user/CLionProjects/cppcheck/cli/cppcheckexecutor.cpp:204
    #10 0x636012573d13 in main /home/user/CLionProjects/cppcheck/cli/main.cpp:91
    #11 0x7f413ea43ccf  (/usr/lib/libc.so.6+0x29ccf) (BuildId: 0865c4b9ba13e0094e8b45b78dfc7a2971f536d2)
    #12 0x7f413ea43d89 in __libc_start_main (/usr/lib/libc.so.6+0x29d89) (BuildId: 0865c4b9ba13e0094e8b45b78dfc7a2971f536d2)
    #13 0x6360106bb534 in _start (/home/user/CLionProjects/cppcheck/cmake-build-debug-gcc-asan-ubsan/bin/cppcheck+0x4f39534) (BuildId: 898fa100dc84a3116411278d71aeba570e5f512e)