Merge branch 'cppcheck-opensource:main' into fixrecheckingui

Author: wjakobsson

lib/checkio.cpp

@@ -155,6 +155,8 @@ void CheckIOImpl::checkFileUsage()
                 tok = tok->linkAt(1);
                 continue;
             }
+            if (tok->function() && tok->function()->nestedIn)
+                continue;
             if (tok->str() == "{")
                 indent++;
             else if (tok->str() == "}") {
@@ -841,6 +843,8 @@ void CheckIOImpl::checkFormatString(const Token * const tok,
                 }
                 ++i;
             }
+            while (!width.empty() && width[0] == '0')
+                width = width.substr(1);
             auto bracketBeg = formatString.cend();
             if (i != formatString.cend() && *i == '[') {
                 bracketBeg = i;

lib/tokenize.cpp

@@ -589,12 +589,27 @@ namespace {
                 }
             }
 
+            const auto checkForRecursion = [this]() {
+                if (Token::Match(mTypedefToken, "typedef %name% %name% ;"))
+                    return;
+                for (const Token *tok = mTypedefToken; tok != mEndToken; tok = tok->next()) {
+                    if (tok == mNameToken)
+                        continue;
+                    if (tok->str() != mNameToken->str())
+                        continue;
+                    if (Token::Match(tok->previous(), "struct|class|enum|union"))
+                        continue;
+                    throw InternalError(tok, "recursive typedef encountered");
+                }
+            };
+
             for (Token* type = start; Token::Match(type, "%name%|*|&|&&"); type = type->next()) {
                 if (type != start && Token::Match(type, "%name% ;") && !type->isStandardType()) {
                     mRangeType.first = start;
                     mRangeType.second = type;
                     mNameToken = type;
                     mEndToken = mNameToken->next();
+                    checkForRecursion();
                     return;
                 }
                 if (type != start && Token::Match(type, "%name% [")) {
@@ -609,6 +624,7 @@ namespace {
                     mEndToken = end->next();
                     mRangeAfterVar.first = mNameToken->next();
                     mRangeAfterVar.second = mEndToken;
+                    checkForRecursion();
                     return;
                 }
                 if (Token::Match(type->next(), "( * const| %name% ) (") && Token::simpleMatch(type->linkAt(1)->linkAt(1), ") ;")) {
@@ -618,6 +634,7 @@ namespace {
                     mRangeType.second = mNameToken;
                     mRangeAfterVar.first = mNameToken->next();
                     mRangeAfterVar.second = mEndToken;
+                    checkForRecursion();
                     return;
                 }
                 if (type != start && Token::Match(type, "%name% ( !!(") && Token::simpleMatch(type->linkAt(1), ") ;") && !type->isStandardType()) {
@@ -627,6 +644,7 @@ namespace {
                     mRangeType.second = type;
                     mRangeAfterVar.first = mNameToken->next();
                     mRangeAfterVar.second = mEndToken;
+                    checkForRecursion();
                     return;
                 }
             }

lib/tokenlist.cpp

@@ -1947,6 +1947,9 @@ void TokenList::validateAst(bool print) const
         if ((tok->isAssignmentOp() || tok->isComparisonOp() || Token::Match(tok,"[|^/%]")) && tok->astOperand1() && !tok->astOperand2())
             throw InternalError(tok, "Syntax Error: AST broken, binary operator has only one operand.", InternalError::AST);
 
+        if (!(tok->astOperand1() && tok->astOperand2()) && ((isC() && tok->str() == "&&") || Token::Match(tok, "%or%|%oror%")))
+            throw InternalError(tok, "Syntax Error: AST broken, binary operator is missing operand(s).", InternalError::AST);
+
         // Syntax error if we encounter "?" with operand2 that is not ":"
         if (tok->str() == "?") {
             if (!tok->astOperand1() || !tok->astOperand2())
@@ -2029,9 +2032,9 @@ void TokenList::validateAst(bool print) const
                                     "' doesn't have two operands.",
                                     InternalError::AST);
         }
-        if (tok->str() == "case" && !tok->astOperand1()) {
+        if (!tok->astOperand1() && Token::Match(tok, "case|!")) {
             throw InternalError(tok,
-                                "Syntax Error: AST broken, 'case' doesn't have an operand.",
+                                "Syntax Error: AST broken, '" + tok->str() + "' doesn't have an operand.",
                                 InternalError::AST);
         }
 

test/cli/fuzz-crash_c/crash-401f925d3c6fd78f864ffd7bf0531bd6a76bb832

@@ -0,0 +1 @@
+i(){!!:!=!&&d}

test/cli/fuzz-crash_c/crash-85cab41781812453dfc8e74e1f0b915225f7a0a1

@@ -0,0 +1 @@
+n(f=n){n&&,n}

test/cli/fuzz-timeout/timeout-242e02017d15d072fd7a230de22faeef0816693d

@@ -0,0 +1 @@
+typedef const v*v,*;

test/testio.cpp

@@ -53,6 +53,7 @@ class TestIO : public TestFixture {
         TEST_CASE(testScanf3); // #3494
         TEST_CASE(testScanf4); // #ticket 2553
         TEST_CASE(testScanf5); // #10632
+        TEST_CASE(testScanf6);
 
         mNewTemplate = false;
         TEST_CASE(testScanfArgument);
@@ -693,6 +694,23 @@ class TestIO : public TestFixture {
               "    fwrite(X::data(), sizeof(char), buffer.size(), d->file);\n"
               "}");
         ASSERT_EQUALS("[test.cpp:9:5]: (error) Read and write operations without a call to a positioning function (fseek, fsetpos or rewind) or fflush in between result in undefined behaviour. [IOWithoutPositioning]\n", errout_str());
+
+        check("struct MemStream {\n"
+              "    char buf[1024];\n"
+              "    int pos = 0;\n"
+              "    void fwrite(const void *ptr, size_t n) { memcpy(buf + pos, ptr, n); pos += (int)n; }\n"
+              "};\n"
+              "struct FileStream {\n"
+              "    FILE *fp;\n"
+              "    size_t _fread(void *ptr, size_t n) { return ::fread(ptr, 1, n, fp); }\n"
+              "    size_t fread(void *ptr, size_t n) { return _fread(ptr, n); }\n"
+              "    void copy_to(MemStream *dst, size_t n) {\n"
+              "        char tmp[256];\n"
+              "        fread(tmp, n);\n"
+              "        dst->fwrite(tmp, n);\n"
+              "    }\n"
+              "};\n");
+        ASSERT_EQUALS("", errout_str());
     }
 
     void seekOnAppendedFile() {
@@ -892,6 +910,14 @@ class TestIO : public TestFixture {
                       "[test.cpp:3:5]: (error) Width 42 given in format string (no. 2) is larger than destination buffer 's2[42]', use %41[a-z] to prevent overflowing it. [invalidScanfFormatWidth]\n", errout_str());
     }
 
+    void testScanf6() {
+        ASSERT_NO_THROW(check("int f(const char *p) {\n"
+                              "        char a[3];\n"
+                              "        return sscanf(p, \"%02s\", a);\n"
+                              "}\n"));
+        ASSERT_EQUALS("", errout_str());
+    }
+
 
 #define TEST_SCANF_CODE(format, type) \
     "void f(){" type " x; scanf(\"" format "\", &x);}"

test/testsimplifytypedef.cpp

@@ -233,6 +233,7 @@ class TestSimplifyTypedef : public TestFixture {
         TEST_CASE(simplifyTypedef160);
         TEST_CASE(simplifyTypedef161);
         TEST_CASE(simplifyTypedef162);
+        TEST_CASE(simplifyTypedef163);
 
         TEST_CASE(simplifyTypedefFunction1);
         TEST_CASE(simplifyTypedefFunction2); // ticket #1685
@@ -3836,11 +3837,11 @@ class TestSimplifyTypedef : public TestFixture {
                            "}";
         ASSERT_EQUALS(exp, tok(code));
 
-        const char code2[] = "typedef stuct T* T;\n" // #14669
+        const char code2[] = "typedef struct T* T;\n" // #14669
                              "struct T {\n"
                              "    T p;\n"
                              "};\n";
-        const char exp2[] = "struct T { stuct T * p ; } ;";
+        const char exp2[] = "struct T { struct T * p ; } ;";
         ASSERT_EQUALS(exp2, simplifyTypedefC(code2));
     }
 
@@ -3868,6 +3869,11 @@ class TestSimplifyTypedef : public TestFixture {
         ASSERT_EQUALS(exp, tok(code));
     }
 
+    void simplifyTypedef163() {
+        const char code[] = "typedef v *v;";
+        ASSERT_THROW_INTERNAL(tok(code), INTERNAL);
+    }
+
     void simplifyTypedefFunction1() {
         {
             const char code[] = "typedef void (*my_func)();\n"

test/testtokenize.cpp

@@ -92,6 +92,7 @@ class TestTokenizer : public TestFixture {
         TEST_CASE(tokenize40);  // #13181
         TEST_CASE(tokenize41);  // #13847
         TEST_CASE(tokenize42);  // #13861
+        TEST_CASE(tokenize43);  // #13861
 
         TEST_CASE(validate);
 
@@ -941,6 +942,12 @@ class TestTokenizer : public TestFixture {
         (void)errout_str();
     }
 
+    void tokenize43() {
+        const char code[] = "void f(int i) { do if (i &= 1) {} while (0); }";
+        ASSERT_NO_THROW(tokenizeAndStringify(code));
+        (void)errout_str();
+    }
+
     void validate() {
         // C++ code in C file
         ASSERT_THROW_INTERNAL(tokenizeAndStringify(";using namespace std;",dinit(TokenizeOptions, $.expand = false, $.cpp = false)), SYNTAX);