Skip to content

Commit e15927d

Browse files
Fix heap-use-after-free in Tokenizer::simplifyUsing()
1 parent 86f4c91 commit e15927d

2 files changed

Lines changed: 9 additions & 3 deletions

File tree

lib/tokenize.cpp

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3015,7 +3015,6 @@ bool Tokenizer::simplifyUsing()
30153015
Token::Match(tok->linkAt(2), "] ] = ::| %name%")))))
30163016
continue;
30173017

3018-
const std::string& name = tok->strAt(1);
30193018
const Token *nameToken = tok->next();
30203019
std::string scope = currentScope->fullName;
30213020
Token *usingStart = tok;
@@ -3064,7 +3063,7 @@ bool Tokenizer::simplifyUsing()
30643063
if (!hasName) {
30653064
std::string newName;
30663065
if (structEnd->strAt(2) == ";")
3067-
newName = name;
3066+
newName = nameToken->str();
30683067
else
30693068
newName = "Unnamed" + std::to_string(mUnnamedCount++);
30703069
TokenList::copyTokens(structEnd->next(), tok, start);
@@ -3211,7 +3210,7 @@ bool Tokenizer::simplifyUsing()
32113210
if (!isTypedefInfoAdded && Token::Match(tok1, "%name% (")) {
32123211
isTypedefInfoAdded = true;
32133212
TypedefInfo usingInfo;
3214-
usingInfo.name = name;
3213+
usingInfo.name = nameToken->str();
32153214
usingInfo.filename = list.file(nameToken);
32163215
usingInfo.lineNumber = nameToken->linenr();
32173216
usingInfo.column = nameToken->column();

test/testsimplifyusing.cpp

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -77,6 +77,7 @@ class TestSimplifyUsing : public TestFixture {
7777
TEST_CASE(simplifyUsing37);
7878
TEST_CASE(simplifyUsing38);
7979
TEST_CASE(simplifyUsing39);
80+
TEST_CASE(simplifyUsing40);
8081

8182
TEST_CASE(simplifyUsing8970);
8283
TEST_CASE(simplifyUsing8971);
@@ -939,6 +940,12 @@ class TestSimplifyUsing : public TestFixture {
939940
ASSERT_EQUALS("", errout_str());
940941
}
941942

943+
void simplifyUsing40() {
944+
const char code[] = "using C = struct C { C() {} };";
945+
const char expected[] = "struct C { C ( ) { } } ;";
946+
ASSERT_EQUALS(expected, tok(code));
947+
}
948+
942949
void simplifyUsing8970() {
943950
const char code[] = "using V = std::vector<int>;\n"
944951
"struct A {\n"

0 commit comments

Comments
 (0)