Fix #14914: fuzzing timeout (hang) in Tokenizer::simplifyTypedef() (#8762)

Author: ludviggunne

lib/tokenize.cpp

@@ -563,6 +563,20 @@ namespace {
             if (Token::simpleMatch(start, "typename"))
                 start = start->next();
 
+            const auto checkForRecursion = [this]() {
+                if (Token::Match(mTypedefToken, "typedef %name% %name% ;"))
+                    return;
+                for (const Token *tok = mTypedefToken; tok != mEndToken; tok = tok->next()) {
+                    if (tok == mNameToken)
+                        continue;
+                    if (tok->str() != mNameToken->str())
+                        continue;
+                    if (Token::Match(tok->previous(), "struct|class|enum|union"))
+                        continue;
+                    throw InternalError(tok, "recursive typedef encountered");
+                }
+            };
+
             // TODO handle unnamed structs etc
             if (Token::Match(start, "const| enum|struct|union|class %name%| {")) {
                 const std::pair<const Token*, Token*> rangeBefore(start, Token::findsimplematch(start, "{"));
@@ -585,24 +599,11 @@ namespace {
                     }
                     mNameToken = nameTok;
                     mEndToken = nameTok->next();
+                    checkForRecursion();
                     return;
                 }
             }
 
-            const auto checkForRecursion = [this]() {
-                if (Token::Match(mTypedefToken, "typedef %name% %name% ;"))
-                    return;
-                for (const Token *tok = mTypedefToken; tok != mEndToken; tok = tok->next()) {
-                    if (tok == mNameToken)
-                        continue;
-                    if (tok->str() != mNameToken->str())
-                        continue;
-                    if (Token::Match(tok->previous(), "struct|class|enum|union"))
-                        continue;
-                    throw InternalError(tok, "recursive typedef encountered");
-                }
-            };
-
             for (Token* type = start; Token::Match(type, "%name%|*|&|&&"); type = type->next()) {
                 if (type != start && Token::Match(type, "%name% ;") && !type->isStandardType()) {
                     mRangeType.first = start;

test/cli/fuzz-timeout/oom-6fd8356f0baeb3bb43463298803b94ac8ea93cac

@@ -0,0 +1 @@
+typedef struct D{itoftor;}tor tor;

test/testsimplifytypedef.cpp

@@ -234,6 +234,7 @@ class TestSimplifyTypedef : public TestFixture {
         TEST_CASE(simplifyTypedef161);
         TEST_CASE(simplifyTypedef162);
         TEST_CASE(simplifyTypedef163);
+        TEST_CASE(simplifyTypedef164);
 
         TEST_CASE(simplifyTypedefFunction1);
         TEST_CASE(simplifyTypedefFunction2); // ticket #1685
@@ -3874,6 +3875,11 @@ class TestSimplifyTypedef : public TestFixture {
         ASSERT_THROW_INTERNAL(tok(code), INTERNAL);
     }
 
+    void simplifyTypedef164() {
+        const char code[] = "typedef struct D{x;}y y;";
+        ASSERT_THROW_INTERNAL(tok(code), INTERNAL);
+    }
+
     void simplifyTypedefFunction1() {
         {
             const char code[] = "typedef void (*my_func)();\n"