Fix #13566 fuzzing crash in ValueFlowAnalyzer::assume() (#7245)

Author: chrchr-github

Diff for: lib/tokenize.cpp

@@ -8545,26 +8545,34 @@ void Tokenizer::findGarbageCode() const
                 syntaxError(tok);
         }
 
-        if (tok->isControlFlowKeyword() && Token::Match(tok, "if|while|for|switch")) { // if|while|for|switch (EXPR) { ... }
-            if (tok->previous() && !Token::Match(tok->previous(), "%name%|:|;|{|}|)")) {
-                if (Token::Match(tok->previous(), "[,(]")) {
-                    const Token *prev = tok->previous();
-                    while (prev && prev->str() != "(") {
-                        if (prev->str() == ")")
-                            prev = prev->link();
-                        prev = prev->previous();
+        if (tok->isControlFlowKeyword()) {
+            if (Token::Match(tok, "if|while|for|switch")) { // if|while|for|switch (EXPR) { ... }
+                if (tok->previous() && !Token::Match(tok->previous(), "%name%|:|;|{|}|)")) {
+                    if (Token::Match(tok->previous(), "[,(]")) {
+                        const Token *prev = tok->previous();
+                        while (prev && prev->str() != "(") {
+                            if (prev->str() == ")")
+                                prev = prev->link();
+                            prev = prev->previous();
+                        }
+                        if (prev && Token::Match(prev->previous(), "%name% ("))
+                            unknownMacroError(prev->previous());
                     }
-                    if (prev && Token::Match(prev->previous(), "%name% ("))
-                        unknownMacroError(prev->previous());
+                    if (!Token::simpleMatch(tok->tokAt(-2), "operator \"\" if"))
+                        syntaxError(tok);
                 }
-                if (!Token::simpleMatch(tok->tokAt(-2), "operator \"\" if"))
+                if (!Token::Match(tok->next(), "( !!)"))
                     syntaxError(tok);
+                if (tok->str() != "for") {
+                    if (isGarbageExpr(tok->next(), tok->linkAt(1), cpp && (mSettings.standards.cpp>=Standards::cppstd_t::CPP17)))
+                        syntaxError(tok);
+                }
             }
-            if (!Token::Match(tok->next(), "( !!)"))
-                syntaxError(tok);
-            if (tok->str() != "for") {
-                if (isGarbageExpr(tok->next(), tok->linkAt(1), cpp && (mSettings.standards.cpp>=Standards::cppstd_t::CPP17)))
-                    syntaxError(tok);
+            if (Token::simpleMatch(tok, "do {")) {
+                if (!Token::simpleMatch(tok->linkAt(1), "} while ("))
+                    syntaxError(tok->linkAt(1));
+                if (!Token::simpleMatch(tok->linkAt(1)->linkAt(2), ") ;"))
+                    syntaxError(tok->linkAt(1)->linkAt(2));
             }
         }
 

Diff for: test/cli/fuzz-crash_c/crash-c43160a021f72643e229bb61306240d0dbf2c9bd

@@ -0,0 +1 @@
+f(a b){do{if(b){}}while(e)x}

Diff for: test/testother.cpp

@@ -10842,31 +10842,31 @@ class TestOther : public TestFixture {
               "unsigned char c;\n"
               "do {\n"
               "  c = getc (pFile);\n"
-              "} while (c != EOF)"
+              "} while (c != EOF);"
               "}");
         ASSERT_EQUALS("[test.cpp:5]: (warning) Storing getc() return value in char variable and then comparing with EOF.\n", errout_str());
 
         check("void f (FILE * pFile){\n"
               "unsigned char c;\n"
               "do {\n"
               "  c = getc (pFile);\n"
-              "} while (EOF != c)"
+              "} while (EOF != c);"
               "}");
         ASSERT_EQUALS("[test.cpp:5]: (warning) Storing getc() return value in char variable and then comparing with EOF.\n", errout_str());
 
         check("void f (FILE * pFile){\n"
               "int i;\n"
               "do {\n"
               "  i = getc (pFile);\n"
-              "} while (i != EOF)"
+              "} while (i != EOF);"
               "}");
         ASSERT_EQUALS("", errout_str());
 
         check("void f (FILE * pFile){\n"
               "int i;\n"
               "do {\n"
               "  i = getc (pFile);\n"
-              "} while (EOF != i)"
+              "} while (EOF != i);"
               "}");
         ASSERT_EQUALS("", errout_str());
 
@@ -10876,39 +10876,39 @@ class TestOther : public TestFixture {
               "unsigned char c;\n"
               "do {\n"
               "  c = fgetc (pFile);\n"
-              "} while (c != EOF)"
+              "} while (c != EOF);"
               "}");
         ASSERT_EQUALS("[test.cpp:5]: (warning) Storing fgetc() return value in char variable and then comparing with EOF.\n", errout_str());
 
         check("void f (FILE * pFile){\n"
               "char c;\n"
               "do {\n"
               "  c = fgetc (pFile);\n"
-              "} while (EOF != c)"
+              "} while (EOF != c);"
               "}");
         ASSERT_EQUALS("[test.cpp:5]: (warning) Storing fgetc() return value in char variable and then comparing with EOF.\n", errout_str());
 
         check("void f (FILE * pFile){\n"
               "signed char c;\n"
               "do {\n"
               "  c = fgetc (pFile);\n"
-              "} while (EOF != c)"
+              "} while (EOF != c);"
               "}");
         ASSERT_EQUALS("", errout_str());
 
         check("void f (FILE * pFile){\n"
               "int i;\n"
               "do {\n"
               "  i = fgetc (pFile);\n"
-              "} while (i != EOF)"
+              "} while (i != EOF);"
               "}");
         ASSERT_EQUALS("", errout_str());
 
         check("void f (FILE * pFile){\n"
               "int i;\n"
               "do {\n"
               "  i = fgetc (pFile);\n"
-              "} while (EOF != i)"
+              "} while (EOF != i);"
               "}");
         ASSERT_EQUALS("", errout_str());
 

Diff for: test/testvalueflow.cpp

@@ -4241,7 +4241,7 @@ class TestValueFlow : public TestFixture {
                "    do {\n"
                "        if (pvd.descr_type == 0xff) {}\n"
                "        dostuff(&pvd);\n"
-               "    } while (condition)\n"
+               "    } while (condition);\n"
                "}";
         values = removeImpossible(tokenValues(code, "=="));
         ASSERT_EQUALS(1, values.size());