Fix segfault in template simplifier

thomasjfox · thomasjfox · commit cd4c297dcec5 · 2015-01-18T01:43:43.000+01:00
When something parsing the template syntax
went wrong, "tok2" was NULL and resulted
in deleting all remaining tokens. Whoops.

Triggered by gcc test suite:
gcc/testsuite/g++.dg/cpp0x/variadic87.C

Tracked down the source of the bug with
valgrind's "--track-origins=yes" switch.
diff --git a/lib/templatesimplifier.cpp b/lib/templatesimplifier.cpp
@@ -658,6 +658,11 @@ void TemplateSimplifier::useDefaultArgumentValues(const std::list<Token *> &temp
                 if (indentlevel < 0)
                     break;
             }
+            // something went wrong, don't call eraseTokens()
+            // with a nullptr "end" parameter (=all remaining tokens).
+            if (!tok2)
+                continue;
+
             Token::eraseTokens(eqtok, tok2);
             eqtok->deleteThis();
         }

Original file line number	Diff line number	Diff line change
`@@ -658,6 +658,11 @@ void TemplateSimplifier::useDefaultArgumentValues(const std::list<Token *> &temp`
`658`	`658`	`if (indentlevel < 0)`
`659`	`659`	`break;`
`660`	`660`	`}`
	`661`	`+ // something went wrong, don't call eraseTokens()`
	`662`	`+ // with a nullptr "end" parameter (=all remaining tokens).`
	`663`	`+ if (!tok2)`
	`664`	`+ continue;`
	`665`	`+`
`661`	`666`	`Token::eraseTokens(eqtok, tok2);`
`662`	`667`	`eqtok->deleteThis();`
`663`	`668`	`}`