Fix #13689 fuzzing crash (invalid-bool-load) in CheckUninitVar::checkLoopBodyRecursive() (danmar#8114)

chrchr-github · web-flow · commit 92b7624ca156 · 2026-01-13T21:52:17.000+01:00
diff --git a/lib/checkuninitvar.cpp b/lib/checkuninitvar.cpp
@@ -965,7 +965,7 @@ const Token* CheckUninitVar::checkLoopBodyRecursive(const Token *start, const Va
                 return nullptr;
             }
 
-            bool alwaysReturnsUnused;
+            bool alwaysReturnsUnused = false;
             const Token *errorToken1 = checkLoopBodyRecursive(tok, var, alloc, membervar, bailout, alwaysReturnsUnused);
             tok = tok->link();
             if (Token::simpleMatch(tok, "} else {")) {
diff --git a/test/cli/fuzz-crash_c/crash-8367ada820697bc89f56262df59bdf457b62c808 b/test/cli/fuzz-crash_c/crash-8367ada820697bc89f56262df59bdf457b62c808
@@ -0,0 +1 @@
+i(){s a;for(;;)y{for(;;);};}

Original file line number	Diff line number	Diff line change
`@@ -965,7 +965,7 @@ const Token* CheckUninitVar::checkLoopBodyRecursive(const Token *start, const Va`
`965`	`965`	`return nullptr;`
`966`	`966`	`}`
`967`	`967`
`968`		`- bool alwaysReturnsUnused;`
	`968`	`+ bool alwaysReturnsUnused = false;`
`969`	`969`	`const Token *errorToken1 = checkLoopBodyRecursive(tok, var, alloc, membervar, bailout, alwaysReturnsUnused);`
`970`	`970`	`tok = tok->link();`
`971`	`971`	`if (Token::simpleMatch(tok, "} else {")) {`