Fix 10496: crash: endless recursion (symbolDatabaseCreateExprId => isSameExpr => isSameExpr ...) (cppcheck-opensource#3467)

pfultz2 · web-flow · commit 5c3b69fe966f · 2021-09-25T11:55:49.000+02:00
diff --git a/lib/astutils.cpp b/lib/astutils.cpp
@@ -169,9 +169,9 @@ bool astHasToken(const Token* root, const Token * tok)
 {
     if (!root)
         return false;
-    if (root == tok)
-        return true;
-    return astHasToken(root->astOperand1(), tok) || astHasToken(root->astOperand2(), tok);
+    while (tok->astParent() && tok != root)
+        tok = tok->astParent();
+    return root == tok;
 }
 
 bool astHasVar(const Token * tok, nonneg int varid)
@@ -833,6 +833,8 @@ std::vector<ReferenceToken> followAllReferences(const Token* tok,
                 errors.emplace_back(var->declEndToken(), "Passed to reference.");
                 return {{tok, std::move(errors)}};
             } else if (Token::simpleMatch(var->declEndToken(), "=")) {
+                if (astHasToken(var->declEndToken(), tok))
+                    return std::vector<ReferenceToken>{};
                 errors.emplace_back(var->declEndToken(), "Assigned to reference.");
                 const Token *vartok = var->declEndToken()->astOperand2();
                 if (vartok == tok || (!temporary && isTemporary(true, vartok, nullptr, true) &&
diff --git a/test/testtokenize.cpp b/test/testtokenize.cpp
@@ -409,6 +409,7 @@ class TestTokenizer : public TestFixture {
         TEST_CASE(checkIfCppCast);
         TEST_CASE(checkRefQualifiers);
         TEST_CASE(checkConditionBlock);
+        TEST_CASE(checkUnknownCircularVar);
 
         // #9052
         TEST_CASE(noCrash1);
@@ -6845,6 +6846,14 @@ class TestTokenizer : public TestFixture {
                                              "}\n"));
     }
 
+    void checkUnknownCircularVar()
+    {
+        ASSERT_NO_THROW(tokenizeAndStringify("void execute() {\n"
+                                             "    const auto &bias = GEMM_CTX_ARG_STORAGE(bias);\n"
+                                             "    auto &c = GEMM_CTX_ARG_STORAGE(c);\n"
+                                             "}\n"));
+    }
+
     void noCrash1() {
         ASSERT_NO_THROW(tokenizeAndStringify(
                             "struct A {\n"
