Fix #13492 Use-after-free in simplifyUsing() (#7143)

danmar · Dec 29, 2024 · 1fb14d6 · 1fb14d6
1 parent 360189d
commit 1fb14d6
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 6 deletions.
diff --git a/lib/tokenize.cpp b/lib/tokenize.cpp
@@ -3386,12 +3386,7 @@ bool Tokenizer::simplifyUsing()
         Token *usingStart = it->startTok;
         Token *usingEnd = it->endTok;
         if (usingStart->previous()) {
-            if (usingEnd->next())
-                Token::eraseTokens(usingStart->previous(), usingEnd->next());
-            else {
-                Token::eraseTokens(usingStart->previous(), usingEnd);
-                usingEnd->deleteThis();
-            }
+            Token::eraseTokens(usingStart->previous(), usingEnd->next());
         } else {
             if (usingEnd->next()) {
                 Token::eraseTokens(usingStart, usingEnd->next());

diff --git a/test/testsimplifyusing.cpp b/test/testsimplifyusing.cpp
@@ -74,6 +74,7 @@ class TestSimplifyUsing : public TestFixture {
         TEST_CASE(simplifyUsing32);
         TEST_CASE(simplifyUsing33);
         TEST_CASE(simplifyUsing34);
+        TEST_CASE(simplifyUsing35);
 
         TEST_CASE(simplifyUsing8970);
         TEST_CASE(simplifyUsing8971);
@@ -854,6 +855,14 @@ class TestSimplifyUsing : public TestFixture {
         ASSERT_EQUALS("", errout_str());
     }
 
+    void simplifyUsing35() { // #13492
+        const char code[] = "using a = b;\n"
+                            "using c = d;\n";
+        const char expected[] = ";";
+        ASSERT_EQUALS(expected, tok(code));
+        ASSERT_EQUALS("", errout_str());
+    }
+
     void simplifyUsing8970() {
         const char code[] = "using V = std::vector<int>;\n"
                             "struct A {\n"