Fix #14878 fuzzing crash (null-pointer-use) in Tokenizer::simplifyUsing() (#8682)

chrchr-github · web-flow · commit 9162aa7fb9d5 · 2026-07-02T08:25:18.000+02:00
diff --git a/lib/tokenize.cpp b/lib/tokenize.cpp
@@ -3470,6 +3470,8 @@ bool Tokenizer::simplifyUsing()
                 skip = true;
                 simplifyUsingError(usingStart, usingEnd);
             }
+            if (!after)
+                syntaxError(tok1);
             tok1 = after->previous();
         }
 
diff --git a/test/cli/fuzz-crash/crash-42dad53b40278386e4ebd224813e26541cc725f1 b/test/cli/fuzz-crash/crash-42dad53b40278386e4ebd224813e26541cc725f1
@@ -0,0 +1 @@
+using C=C*;C{{}}

Original file line number	Diff line number	Diff line change
`@@ -3470,6 +3470,8 @@ bool Tokenizer::simplifyUsing()`
`3470`	`3470`	`skip = true;`
`3471`	`3471`	`simplifyUsingError(usingStart, usingEnd);`
`3472`	`3472`	`}`
	`3473`	`+ if (!after)`
	`3474`	`+ syntaxError(tok1);`
`3473`	`3475`	`tok1 = after->previous();`
`3474`	`3476`	`}`
`3475`	`3477`