Fix #14437 fuzzing crash (null-pointer-use) in ValueFlowAnalyzer::assume() (#8730)

chrchr-github · web-flow · commit 8e5682d99332 · 2026-07-15T15:55:24.000+02:00
diff --git a/lib/tokenize.cpp b/lib/tokenize.cpp
@@ -6920,7 +6920,7 @@ Token *Tokenizer::simplifyAddBracesToCommand(Token *tok)
             // before the "while"
             if (tokEnd) {
                 tokEnd=tokEnd->next();
-                if (!tokEnd || tokEnd->str()!="while") // no while
+                if (!Token::simpleMatch(tokEnd, "while (") || !Token::simpleMatch(tokEnd->linkAt(1), ") ;")) // no while
                     syntaxError(tok);
             }
         }
diff --git a/test/cli/fuzz-crash/crash-b4bd9ce1af8a423d15d034f42c7b99dc0f8a0a7d b/test/cli/fuzz-crash/crash-b4bd9ce1af8a423d15d034f42c7b99dc0f8a0a7d
@@ -0,0 +1 @@
+d o(n c){do if(c){}while(0)n}

Original file line number	Diff line number	Diff line change
`@@ -6920,7 +6920,7 @@ Token Tokenizer::simplifyAddBracesToCommand(Token tok)`
`6920`	`6920`	`// before the "while"`
`6921`	`6921`	`if (tokEnd) {`
`6922`	`6922`	`tokEnd=tokEnd->next();`
`6923`		`- if (!tokEnd \|\| tokEnd->str()!="while") // no while`
	`6923`	`+ if (!Token::simpleMatch(tokEnd, "while (") \|\| !Token::simpleMatch(tokEnd->linkAt(1), ") ;")) // no while`
`6924`	`6924`	`syntaxError(tok);`
`6925`	`6925`	`}`
`6926`	`6926`	`}`