From 7e6aef9d64a019b0db1a22b1bee19f62703c1480 Mon Sep 17 00:00:00 2001 From: chrchr-github Date: Mon, 17 Aug 2026 22:15:50 +0200 Subject: [PATCH 1/2] Fix #14917 fuzzing crash (null-pointer-use) in ReverseTraversal::traverse() --- lib/tokenize.cpp | 3 +++ .../crash-8a4f047728c598ad00d835c16e7fbef5e43e8489 | 1 + 2 files changed, 4 insertions(+) create mode 100644 test/cli/fuzz-crash_c/crash-8a4f047728c598ad00d835c16e7fbef5e43e8489 diff --git a/lib/tokenize.cpp b/lib/tokenize.cpp index 27be2e544a2..62a448a1594 100644 --- a/lib/tokenize.cpp +++ b/lib/tokenize.cpp @@ -3764,6 +3764,9 @@ void Tokenizer::concatenateNegativeNumberAndAnyPositive() if (tok->findOpeningBracket()) continue; + + if (!tok->tokAt(2) || (tok->tokAt(2)->isOp() && !Token::Match(tok->tokAt(2), "[+-]"))) + syntaxError(tok); while (tok->str() != ">" && tok->next() && tok->strAt(1) == "+" && (!Token::Match(tok->tokAt(2), "%name% (|;") || Token::Match(tok, "%op%"))) tok->deleteNext(); diff --git a/test/cli/fuzz-crash_c/crash-8a4f047728c598ad00d835c16e7fbef5e43e8489 b/test/cli/fuzz-crash_c/crash-8a4f047728c598ad00d835c16e7fbef5e43e8489 new file mode 100644 index 00000000000..3b81bf6f322 --- /dev/null +++ b/test/cli/fuzz-crash_c/crash-8a4f047728c598ad00d835c16e7fbef5e43e8489 @@ -0,0 +1 @@ +n(S=n){n*,+&&n} \ No newline at end of file From 4eacf8f476f34ee2c6e6ea69903df9dfa03052ed Mon Sep 17 00:00:00 2001 From: chrchr-github Date: Mon, 17 Aug 2026 22:20:18 +0200 Subject: [PATCH 2/2] Format --- lib/tokenize.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/tokenize.cpp b/lib/tokenize.cpp index 62a448a1594..57ed921f50c 100644 --- a/lib/tokenize.cpp +++ b/lib/tokenize.cpp @@ -3764,7 +3764,7 @@ void Tokenizer::concatenateNegativeNumberAndAnyPositive() if (tok->findOpeningBracket()) continue; - + if (!tok->tokAt(2) || (tok->tokAt(2)->isOp() && !Token::Match(tok->tokAt(2), "[+-]"))) syntaxError(tok);