Fix #14901: fuzzing timeout (hang) in Tokenizer::simplifyTypedef() (#8717)

Author: ludviggunne

lib/tokenize.cpp

@@ -589,12 +589,27 @@ namespace {
                 }
             }
 
+            const auto checkForRecursion = [this]() {
+                if (Token::Match(mTypedefToken, "typedef %name% %name% ;"))
+                    return;
+                for (const Token *tok = mTypedefToken; tok != mEndToken; tok = tok->next()) {
+                    if (tok == mNameToken)
+                        continue;
+                    if (tok->str() != mNameToken->str())
+                        continue;
+                    if (Token::Match(tok->previous(), "struct|class|enum|union"))
+                        continue;
+                    throw InternalError(tok, "recursive typedef encountered");
+                }
+            };
+
             for (Token* type = start; Token::Match(type, "%name%|*|&|&&"); type = type->next()) {
                 if (type != start && Token::Match(type, "%name% ;") && !type->isStandardType()) {
                     mRangeType.first = start;
                     mRangeType.second = type;
                     mNameToken = type;
                     mEndToken = mNameToken->next();
+                    checkForRecursion();
                     return;
                 }
                 if (type != start && Token::Match(type, "%name% [")) {
@@ -609,6 +624,7 @@ namespace {
                     mEndToken = end->next();
                     mRangeAfterVar.first = mNameToken->next();
                     mRangeAfterVar.second = mEndToken;
+                    checkForRecursion();
                     return;
                 }
                 if (Token::Match(type->next(), "( * const| %name% ) (") && Token::simpleMatch(type->linkAt(1)->linkAt(1), ") ;")) {
@@ -618,6 +634,7 @@ namespace {
                     mRangeType.second = mNameToken;
                     mRangeAfterVar.first = mNameToken->next();
                     mRangeAfterVar.second = mEndToken;
+                    checkForRecursion();
                     return;
                 }
                 if (type != start && Token::Match(type, "%name% ( !!(") && Token::simpleMatch(type->linkAt(1), ") ;") && !type->isStandardType()) {
@@ -627,6 +644,7 @@ namespace {
                     mRangeType.second = type;
                     mRangeAfterVar.first = mNameToken->next();
                     mRangeAfterVar.second = mEndToken;
+                    checkForRecursion();
                     return;
                 }
             }

test/cli/fuzz-timeout/timeout-242e02017d15d072fd7a230de22faeef0816693d

@@ -0,0 +1 @@
+typedef const v*v,*;

test/testsimplifytypedef.cpp

@@ -233,6 +233,7 @@ class TestSimplifyTypedef : public TestFixture {
         TEST_CASE(simplifyTypedef160);
         TEST_CASE(simplifyTypedef161);
         TEST_CASE(simplifyTypedef162);
+        TEST_CASE(simplifyTypedef163);
 
         TEST_CASE(simplifyTypedefFunction1);
         TEST_CASE(simplifyTypedefFunction2); // ticket #1685
@@ -3836,11 +3837,11 @@ class TestSimplifyTypedef : public TestFixture {
                            "}";
         ASSERT_EQUALS(exp, tok(code));
 
-        const char code2[] = "typedef stuct T* T;\n" // #14669
+        const char code2[] = "typedef struct T* T;\n" // #14669
                              "struct T {\n"
                              "    T p;\n"
                              "};\n";
-        const char exp2[] = "struct T { stuct T * p ; } ;";
+        const char exp2[] = "struct T { struct T * p ; } ;";
         ASSERT_EQUALS(exp2, simplifyTypedefC(code2));
     }
 
@@ -3868,6 +3869,11 @@ class TestSimplifyTypedef : public TestFixture {
         ASSERT_EQUALS(exp, tok(code));
     }
 
+    void simplifyTypedef163() {
+        const char code[] = "typedef v *v;";
+        ASSERT_THROW_INTERNAL(tok(code), INTERNAL);
+    }
+
     void simplifyTypedefFunction1() {
         {
             const char code[] = "typedef void (*my_func)();\n"