7357 segmentation fault in TokenList::insertTokens

Author: amai2012

lib/tokenize.cpp

@@ -5597,6 +5597,8 @@ void Tokenizer::simplifyVarDecl(Token * tokBegin, Token * tokEnd, bool only_k_r_
                     const Token *varTok = type0->tokAt((int)typelen);
                     while (Token::Match(varTok, "*|&|const"))
                         varTok = varTok->next();
+                    if (!varTok)
+                        syntaxError(tok2); // invalid code
                     list.insertTokens(eq, varTok, 2);
                     eq->str(";");
 

test/testgarbage.cpp

@@ -220,6 +220,7 @@ class TestGarbage : public TestFixture {
         TEST_CASE(garbageCode169); // #6731
         TEST_CASE(garbageCode170);
         TEST_CASE(garbageCode171);
+        TEST_CASE(garbageCode172);
         TEST_CASE(garbageValueFlow);
         TEST_CASE(garbageSymbolDatabase);
         TEST_CASE(garbageAST);
@@ -228,10 +229,10 @@ class TestGarbage : public TestFixture {
 
     std::string checkCode(const char code[], bool cpp = true) {
         // double the tests - run each example as C as well as C++
-        const char* filename = cpp ? "test.cpp" : "test.c";
-        const char* alternatefilename = cpp ? "test.c" : "test.cpp";
+        const char* const filename = cpp ? "test.cpp" : "test.c";
+        const char* const alternatefilename = cpp ? "test.c" : "test.cpp";
 
-        // run alternate check first. It should only ensure stability
+        // run alternate check first. It should only ensure stability - so we catch exceptions here.
         try {
             checkCodeInternal(code, alternatefilename);
         } catch (InternalError&) {
@@ -1448,6 +1449,11 @@ class TestGarbage : public TestFixture {
         ASSERT_THROW(checkCode("(){case()?():}:", false), InternalError);
     }
 
+    void garbageCode172() {
+        // #7357
+        ASSERT_THROW(checkCode("p<e T=l[<]<>>,"), InternalError);
+    }
+
 };
 
 REGISTER_TEST(TestGarbage)