Fix #12565, #12566 Fuzzing crash/timeout

lib/tokenize.cpp

@@ -8610,9 +8610,11 @@ void Tokenizer::findGarbageCode() const
             syntaxError(tok);
         if (Token::Match(tok, "%assign% typename|class %assign%"))
             syntaxError(tok);
+        if (Token::Match(tok, "%assign% [;)}]") && (!isCPP() || !Token::Match(tok->previous(), "operator %assign% ;")))
+            syntaxError(tok);
         if (Token::Match(tok, "%cop%|=|,|[ %or%|%oror%|/|%"))
             syntaxError(tok);
-        if (Token::Match(tok, ";|(|[ %comp%"))
+        if (Token::Match(tok, "[;([{] %comp%|&&|%oror%|%or%|%|/"))
             syntaxError(tok);
         if (Token::Match(tok, "%cop%|= ]") && !(isCPP() && Token::Match(tok->previous(), "%type%|[|,|%num% &|=|> ]")))
             syntaxError(tok);

test/cli/fuzz-crash/crash-20efd8856e04ca1fced9daa93837ae3384bb5e62

@@ -0,0 +1 @@
+assert({:=;})

test/cli/fuzz-timeout/timeout-9598595ae3c480b58773e85cd4e4d52b1dc37038

@@ -0,0 +1 @@
+i f(n*a){n b=0;*a=b;%*a=b;--------------------b}

test/testgarbage.cpp

@@ -1636,7 +1636,7 @@ class TestGarbage : public TestFixture {
     }
 
     void garbageCode203() { // #8972
-        checkCode("{ > () {} }");
+        ASSERT_THROW(checkCode("{ > () {} }"), InternalError);
         checkCode("template <> a > ::b();");
     }
 

test/testtoken.cpp

@@ -743,20 +743,20 @@ class TestToken : public TestFixture {
         ASSERT_EQUALS(true, Token::Match(negative.front(), "%bool%"));
     }
 
-    void matchOr() {
+    void matchOr() const {
         const SimpleTokenList bitwiseOr(";|;");
         // cppcheck-suppress simplePatternError - this is intentional
         ASSERT_EQUALS(true,  Token::Match(bitwiseOr.front(), "; %or%"));
         ASSERT_EQUALS(true,  Token::Match(bitwiseOr.front(), "; %op%"));
         // cppcheck-suppress simplePatternError - this is intentional
         ASSERT_EQUALS(false, Token::Match(bitwiseOr.front(), "; %oror%"));
 
-        const SimpleTokenizer bitwiseOrAssignment(*this, ";|=;");
+        const SimpleTokenList bitwiseOrAssignment(";|=;");
         // cppcheck-suppress simplePatternError - this is intentional
-        ASSERT_EQUALS(false,  Token::Match(bitwiseOrAssignment.tokens(), "; %or%"));
-        ASSERT_EQUALS(true,  Token::Match(bitwiseOrAssignment.tokens(), "; %op%"));
+        ASSERT_EQUALS(false,  Token::Match(bitwiseOrAssignment.front(), "; %or%"));
+        ASSERT_EQUALS(true,  Token::Match(bitwiseOrAssignment.front(), "; %op%"));
         // cppcheck-suppress simplePatternError - this is intentional
-        ASSERT_EQUALS(false, Token::Match(bitwiseOrAssignment.tokens(), "; %oror%"));
+        ASSERT_EQUALS(false, Token::Match(bitwiseOrAssignment.front(), "; %oror%"));
 
         const SimpleTokenList logicalOr(";||;");
         // cppcheck-suppress simplePatternError - this is intentional

test/testtokenize.cpp

@@ -7532,7 +7532,7 @@ class TestTokenizer : public TestFixture {
     void noCrash1() {
         ASSERT_NO_THROW(tokenizeAndStringify(
                             "struct A {\n"
-                            "  A( const std::string &name = " " );\n"
+                            "  A( const std::string &name = \" \" );\n"
                             "};\n"
                             "A::A( const std::string &name ) { return; }\n"));
     }