Fix #12767-70 fuzzing crashes (#6441)

danmar · May 26, 2024 · 51fb56c · 51fb56c
1 parent 98d56b8
commit 51fb56c
Show file tree

Hide file tree

Showing 9 changed files with 29 additions and 7 deletions.
diff --git a/cfg/qt.cfg b/cfg/qt.cfg
@@ -5355,6 +5355,8 @@
   <define name="Q_UNUSED(X)" value="(void)(X);"/>
   <define name="QT_BEGIN_NAMESPACE" value=""/>
   <define name="QT_END_NAMESPACE" value=""/>
+  <define name="QT_BEGIN_MOC_NAMESPACE" value=""/>
+  <define name="QT_END_MOC_NAMESPACE" value=""/>
   <define name="QT_TR_NOOP(x)" value="x"/>
   <define name="QT_TR_NOOP_UTF8(x)" value="x"/>
   <define name="QT_TRANSLATE_NOOP(scope, x)" value="x"/>
@@ -5363,6 +5365,8 @@
   <define name="QT_TRANSLATE_NOOP3_UTF8(scope, x, comment)" value="{x, comment}"/>
   <define name="QT_WARNING_PUSH" value=""/>
   <define name="QT_WARNING_POP" value=""/>
+  <define name="QT_WARNING_DISABLE_GCC(x)" value=""/>
+  <define name="QT_WARNING_DISABLE_DEPRECATED" value=""/>
   <define name="QT_STRINGIFY(x)" value="#x"/>
   <define name="QCOMPARE(actual, expected)" value="(void)((actual)==(expected))"/>
   <define name="QVERIFY(condition)" value="(void)(condition)"/>

diff --git a/lib/tokenize.cpp b/lib/tokenize.cpp
@@ -8706,7 +8706,7 @@ void Tokenizer::findGarbageCode() const
             syntaxError(tok);
         if (Token::Match(tok, ": [)]=]"))
             syntaxError(tok);
-        if (Token::Match(tok, "typedef [,;]"))
+        if (Token::Match(tok, "typedef [,;:]"))
             syntaxError(tok);
         if (Token::Match(tok, "! %comp%"))
             syntaxError(tok);
@@ -8747,6 +8747,16 @@ void Tokenizer::findGarbageCode() const
                     syntaxError(tok);
             }
         }
+        if (isCPP() && tok->str() == "namespace" && tok->tokAt(-1)) {
+            if (!Token::Match(tok->tokAt(-1), ";|{|}|using|inline")) {
+                if (tok->tokAt(-1)->isUpperCaseName())
+                    unknownMacroError(tok->tokAt(-1));
+                else if (tok->linkAt(-1) && tok->linkAt(-1)->tokAt(-1) && tok->linkAt(-1)->tokAt(-1)->isUpperCaseName())
+                    unknownMacroError(tok->linkAt(-1)->tokAt(-1));
+                else
+                    syntaxError(tok);
+            }
+        }
     }
 
     // ternary operator without :
@@ -8772,10 +8782,16 @@ void Tokenizer::findGarbageCode() const
     // Garbage templates..
     if (isCPP()) {
         for (const Token *tok = tokens(); tok; tok = tok->next()) {
-            if (Token::simpleMatch(tok, "< >") && !(Token::Match(tok->tokAt(-1), "%name%") || (tok->tokAt(-1) && Token::Match(tok->tokAt(-2), "operator %op%"))))
-                syntaxError(tok);
+            if (Token::simpleMatch(tok, "< >")) {
+                if (!(Token::Match(tok->tokAt(-1), "%name%") || (tok->tokAt(-1) && Token::Match(tok->tokAt(-2), "operator %op%"))))
+                    syntaxError(tok);
+                if (!tok->tokAt(-1) || tok->tokAt(-1)->isLiteral())
+                    syntaxError(tok);
+            }
             if (!Token::simpleMatch(tok, "template <"))
                 continue;
+            if (!tok->tokAt(2) || tok->tokAt(2)->isLiteral())
+                syntaxError(tok);
             if (tok->previous() && !Token::Match(tok->previous(), ":|;|{|}|)|>|\"C++\"")) {
                 if (tok->previous()->isUpperCaseName())
                     unknownMacroError(tok->previous());

diff --git a/test/cli/fuzz-crash/crash-19269c327fd82c6db8f9f2b0c47c645a721ff55a b/test/cli/fuzz-crash/crash-19269c327fd82c6db8f9f2b0c47c645a721ff55a
@@ -0,0 +1 @@
+n eu<#F A<>;template<#m<>eu=i
diff --git a/test/cli/fuzz-crash/crash-49338578888313fd087eb219d248c9aaf4ea9d0b b/test/cli/fuzz-crash/crash-49338578888313fd087eb219d248c9aaf4ea9d0b
@@ -0,0 +1 @@
+;namespace d=S;r namespace d=X
diff --git a/test/cli/fuzz-crash/crash-81a29a4459dee76d10e452690f3e52fa0172852f b/test/cli/fuzz-crash/crash-81a29a4459dee76d10e452690f3e52fa0172852f
@@ -0,0 +1 @@
+{s for(typedef:;){}}
diff --git a/...3686d79bc9bd0e4025445e3a35fa49.crdownload → ...-adb20a108c3686d79bc9bd0e4025445e3a35fa49 b/...3686d79bc9bd0e4025445e3a35fa49.crdownload → ...-adb20a108c3686d79bc9bd0e4025445e3a35fa49
diff --git a/test/cli/fuzz-timeout/oom-0c8e70d5adb08986635b786737dbb5e6ac098f22 b/test/cli/fuzz-timeout/oom-0c8e70d5adb08986635b786737dbb5e6ac098f22
@@ -0,0 +1 @@
+template<8<>e=e<>>f
diff --git a/test/testsimplifytokens.cpp b/test/testsimplifytokens.cpp
@@ -586,9 +586,7 @@ class TestSimplifyTokens : public TestFixture {
         {
             const char code[] = "void f(int namespace) { }";
 
-            const char expected[] = "void f ( int namespace ) { }";
-
-            ASSERT_EQUALS(expected, tok(code));
+            ASSERT_THROW_INTERNAL(tok(code), SYNTAX);
         }
     }
 

diff --git a/test/testtokenize.cpp b/test/testtokenize.cpp
@@ -5463,7 +5463,7 @@ class TestTokenizer : public TestFixture {
         // remove some unhandled macros in the global scope.
         ASSERT_EQUALS("void f ( ) { }", tokenizeAndStringify("void f() NOTHROW { }"));
         ASSERT_EQUALS("struct Foo { } ;", tokenizeAndStringify("struct __declspec(dllexport) Foo {};"));
-        ASSERT_EQUALS("namespace { int a ; }", tokenizeAndStringify("ABA() namespace { int a ; }"));
+        ASSERT_THROW_INTERNAL(tokenizeAndStringify("ABA() namespace { int a ; }"), UNKNOWN_MACRO);
 
         // #3750
         ASSERT_THROW_INTERNAL(tokenizeAndStringify("; AB(foo*) foo::foo() { }"), UNKNOWN_MACRO);