Skip to content

Commit c8c088f

Browse files
committed
Fix #13501 fuzzing crash (heap-use-after-free) in Tokenizer::simplifyNamespaceAliases()
1 parent dd01ff1 commit c8c088f

2 files changed

Lines changed: 5 additions & 2 deletions

File tree

lib/tokenize.cpp

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8991,15 +8991,17 @@ void Tokenizer::findGarbageCode() const
89918991
}
89928992
}
89938993
}
8994-
if (cpp && tok->str() == "namespace" && tok->tokAt(-1)) {
8995-
if (!Token::Match(tok->tokAt(-1), ";|{|}|using|inline")) {
8994+
if (cpp && tok->str() == "namespace") {
8995+
if (tok->tokAt(-1) && !Token::Match(tok->tokAt(-1), ";|{|}|using|inline")) {
89968996
if (tok->tokAt(-1)->isUpperCaseName())
89978997
unknownMacroError(tok->tokAt(-1));
89988998
else if (tok->linkAt(-1) && tok->linkAt(-1)->tokAt(-1) && tok->linkAt(-1)->tokAt(-1)->isUpperCaseName())
89998999
unknownMacroError(tok->linkAt(-1)->tokAt(-1));
90009000
else
90019001
syntaxError(tok);
90029002
}
9003+
if (!tok->next() || (Token::Match(tok->next(), "%name% =") && !Token::Match(tok->tokAt(3), "::|%name%")))
9004+
syntaxError(tok);
90039005
}
90049006
if (cpp && tok->str() == "using" && !Token::Match(tok->next(), "::|%name%"))
90059007
syntaxError(tok);
Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
;namespace b=i;;namespace b={}

0 commit comments

Comments
 (0)