Fix #13497 fuzzing crash (null-pointer-use) in Tokenizer::simplifyTypedefCpp() (danmar#8100)

chrchr-github · web-flow · commit e2640e7bf2b2 · 2026-01-09T19:26:27.000+01:00
diff --git a/lib/tokenize.cpp b/lib/tokenize.cpp
@@ -1125,6 +1125,8 @@ void Tokenizer::simplifyTypedef()
             list.front()->deleteThis();
     }
 
+    validate();
+
     simplifyTypedefCpp();
 }
 
diff --git a/test/cli/fuzz-crash/crash-0400fbfed5c89e368e436dbac630db0f80db94bd b/test/cli/fuzz-crash/crash-0400fbfed5c89e368e436dbac630db0f80db94bd
@@ -0,0 +1 @@
+typedef i(*const type2)();typedef t(ty)();(v ty)type2()

Original file line number	Diff line number	Diff line change
`@@ -1125,6 +1125,8 @@ void Tokenizer::simplifyTypedef()`
`1125`	`1125`	`list.front()->deleteThis();`
`1126`	`1126`	`}`
`1127`	`1127`
	`1128`	`+ validate();`
	`1129`	`+`
`1128`	`1130`	`simplifyTypedefCpp();`
`1129`	`1131`	`}`
`1130`	`1132`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1 @@`
	`1`	`+typedef i(*const type2)();typedef t(ty)();(v ty)type2()`