Fix #12799 fuzzing crash in Tokenizer::setVarIdPass2() (#6469)

chrchr-github · web-flow · commit abaf3f3331a6 · 2024-06-01T14:27:07.000+02:00
diff --git a/lib/tokenize.cpp b/lib/tokenize.cpp
@@ -8192,7 +8192,7 @@ void Tokenizer::validateC() const
             syntaxErrorC(tok, "template<...");
         if (Token::Match(tok, "%name% :: %name%"))
             syntaxErrorC(tok, tok->str() + tok->strAt(1) + tok->strAt(2));
-        if (Token::Match(tok, "class|namespace %name% [:{]"))
+        if (Token::Match(tok, "class|namespace %name% :|::|{"))
             syntaxErrorC(tok, tok->str() + tok->strAt(1) + tok->strAt(2));
     }
 }
diff --git a/test/cli/fuzz-crash_c/crash-77c74a5f04704110ab5f71b753a623f2d28440bc b/test/cli/fuzz-crash_c/crash-77c74a5f04704110ab5f71b753a623f2d28440bc
@@ -0,0 +1 @@
+class r::_

Original file line number	Diff line number	Diff line change
`@@ -8192,7 +8192,7 @@ void Tokenizer::validateC() const`
`8192`	`8192`	`syntaxErrorC(tok, "template<...");`
`8193`	`8193`	`if (Token::Match(tok, "%name% :: %name%"))`
`8194`	`8194`	`syntaxErrorC(tok, tok->str() + tok->strAt(1) + tok->strAt(2));`
`8195`		`- if (Token::Match(tok, "class\|namespace %name% [:{]"))`
	`8195`	`+ if (Token::Match(tok, "class\|namespace %name% :\|::\|{"))`
`8196`	`8196`	`syntaxErrorC(tok, tok->str() + tok->strAt(1) + tok->strAt(2));`
`8197`	`8197`	`}`
`8198`	`8198`	`}`