Fix #12889 fuzzing crash (heap-use-after-free) in Tokenizer::simplifyTypedef() (#6847)

chrchr-github · web-flow · commit 45b1e8b02c79 · 2024-09-30T21:21:08.000+02:00
diff --git a/lib/tokenize.cpp b/lib/tokenize.cpp
@@ -698,7 +698,7 @@ namespace {
                     mRangeAfterVar.second = mEndToken;
                     return;
                 }
-                if (Token::Match(type, "%name% ( !!(") && Token::simpleMatch(type->linkAt(1), ") ;") && !type->isStandardType()) {
+                if (type != start && Token::Match(type, "%name% ( !!(") && Token::simpleMatch(type->linkAt(1), ") ;") && !type->isStandardType()) {
                     mNameToken = type;
                     mEndToken = type->linkAt(1)->next();
                     mRangeType.first = start;
diff --git a/test/cli/fuzz-crash/crash-a3cfaec435c6df0f6c3cfc83f052abd42c75ba4d b/test/cli/fuzz-crash/crash-a3cfaec435c6df0f6c3cfc83f052abd42c75ba4d
@@ -0,0 +1 @@
+typedef C();typedef const C*(*func2)();d(func2())

Original file line number	Diff line number	Diff line change
`@@ -698,7 +698,7 @@ namespace {`
`698`	`698`	`mRangeAfterVar.second = mEndToken;`
`699`	`699`	`return;`
`700`	`700`	`}`
`701`		`- if (Token::Match(type, "%name% ( !!(") && Token::simpleMatch(type->linkAt(1), ") ;") && !type->isStandardType()) {`
	`701`	`+ if (type != start && Token::Match(type, "%name% ( !!(") && Token::simpleMatch(type->linkAt(1), ") ;") && !type->isStandardType()) {`
`702`	`702`	`mNameToken = type;`
`703`	`703`	`mEndToken = type->linkAt(1)->next();`
`704`	`704`	`mRangeType.first = start;`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1 @@`
	`1`	`+typedef C();typedef const C(func2)();d(func2())`