From 6e142badaafd02a71f350b091252d80aa2468ebc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ludvig=20Gunne=20Lindstr=C3=B6m?= Date: Tue, 28 Jul 2026 16:35:03 +0200 Subject: [PATCH 1/3] add fuzz file --- .../fuzz-timeout/oom-6fd8356f0baeb3bb43463298803b94ac8ea93cac | 1 + 1 file changed, 1 insertion(+) create mode 100644 test/cli/fuzz-timeout/oom-6fd8356f0baeb3bb43463298803b94ac8ea93cac diff --git a/test/cli/fuzz-timeout/oom-6fd8356f0baeb3bb43463298803b94ac8ea93cac b/test/cli/fuzz-timeout/oom-6fd8356f0baeb3bb43463298803b94ac8ea93cac new file mode 100644 index 00000000000..29e36cf8c55 --- /dev/null +++ b/test/cli/fuzz-timeout/oom-6fd8356f0baeb3bb43463298803b94ac8ea93cac @@ -0,0 +1 @@ +typedef struct D{itoftor;}tor tor; \ No newline at end of file From 1c14c731082553cf65b6fa82fc02b51c3a15c408 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ludvig=20Gunne=20Lindstr=C3=B6m?= Date: Tue, 28 Jul 2026 16:33:02 +0200 Subject: [PATCH 2/3] add test --- test/testsimplifytypedef.cpp | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/test/testsimplifytypedef.cpp b/test/testsimplifytypedef.cpp index 5a14399e406..42718a2f99c 100644 --- a/test/testsimplifytypedef.cpp +++ b/test/testsimplifytypedef.cpp @@ -234,6 +234,7 @@ class TestSimplifyTypedef : public TestFixture { TEST_CASE(simplifyTypedef161); TEST_CASE(simplifyTypedef162); TEST_CASE(simplifyTypedef163); + TEST_CASE(simplifyTypedef164); TEST_CASE(simplifyTypedefFunction1); TEST_CASE(simplifyTypedefFunction2); // ticket #1685 @@ -3874,6 +3875,11 @@ class TestSimplifyTypedef : public TestFixture { ASSERT_THROW_INTERNAL(tok(code), INTERNAL); } + void simplifyTypedef164() { + const char code[] = "typedef struct D{x;}y y;"; + ASSERT_THROW_INTERNAL(tok(code), INTERNAL); + } + void simplifyTypedefFunction1() { { const char code[] = "typedef void (*my_func)();\n" From 861ce886047bbd55b80a7621802361aaee676794 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ludvig=20Gunne=20Lindstr=C3=B6m?= Date: Tue, 28 Jul 2026 16:30:59 +0200 Subject: [PATCH 3/3] fix --- lib/tokenize.cpp | 29 +++++++++++++++-------------- 1 file changed, 15 insertions(+), 14 deletions(-) diff --git a/lib/tokenize.cpp b/lib/tokenize.cpp index 031ab624bfb..5ebf6c51951 100644 --- a/lib/tokenize.cpp +++ b/lib/tokenize.cpp @@ -563,6 +563,20 @@ namespace { if (Token::simpleMatch(start, "typename")) start = start->next(); + const auto checkForRecursion = [this]() { + if (Token::Match(mTypedefToken, "typedef %name% %name% ;")) + return; + for (const Token *tok = mTypedefToken; tok != mEndToken; tok = tok->next()) { + if (tok == mNameToken) + continue; + if (tok->str() != mNameToken->str()) + continue; + if (Token::Match(tok->previous(), "struct|class|enum|union")) + continue; + throw InternalError(tok, "recursive typedef encountered"); + } + }; + // TODO handle unnamed structs etc if (Token::Match(start, "const| enum|struct|union|class %name%| {")) { const std::pair rangeBefore(start, Token::findsimplematch(start, "{")); @@ -585,24 +599,11 @@ namespace { } mNameToken = nameTok; mEndToken = nameTok->next(); + checkForRecursion(); return; } } - const auto checkForRecursion = [this]() { - if (Token::Match(mTypedefToken, "typedef %name% %name% ;")) - return; - for (const Token *tok = mTypedefToken; tok != mEndToken; tok = tok->next()) { - if (tok == mNameToken) - continue; - if (tok->str() != mNameToken->str()) - continue; - if (Token::Match(tok->previous(), "struct|class|enum|union")) - continue; - throw InternalError(tok, "recursive typedef encountered"); - } - }; - for (Token* type = start; Token::Match(type, "%name%|*|&|&&"); type = type->next()) { if (type != start && Token::Match(type, "%name% ;") && !type->isStandardType()) { mRangeType.first = start;