Bug#667443: cxref dumps core with function def with function pointer

[John Vogel]

Package: cxref
Version: 1.6c-3
Severity: normal

Greetings,

When cxref encounters a function definition that contains a pointer to function
in the arguments, it segfaults. I have included a smal test file that
demonstrates what I'm seeing. The command line I'm using to reproduce this is:

cxref -xref -CPP "-E -CC -dD -dI" cxref-bomb.c

Trying to use cxref-cpp prevents the segfault, but output is empty except for
the default header from cxref. Switching the comment from the int (*f)(int,int)
to the int f is enough to get cxref through without segfaulting.

I've spent some time trying to get a handle on the fault, but I seems to lead
to the lexer or more likely the parser. If I get some time I'll try to dig
deeper on this. Maybe later this month.

Thanks for your time and efforts

-John



-- System Information:
Debian Release: wheezy/sid
  APT prefers unstable
  APT policy: (900, 'unstable'), (800, 'testing'), (500, 'experimental')
Architecture: amd64 (x86_64)

Kernel: Linux 3.2.0-2-amd64 (SMP w/6 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash

Versions of packages cxref depends on:
ii  debconf [debconf-2.0]  1.5.42
ii  gcc                    4:4.6.3-4
ii  libc6                  2.13-27

cxref recommends no packages.

Versions of packages cxref suggests:
ii  cxref-doc                1.6c-3
ii  iceweasel [www-browser]  10.0.3esr-3
ii  lynx-cur [www-browser]   2.8.8dev.12-2
ii  texlive-binaries         2011.20120328-1

-- Configuration Files:
/etc/cxref/config changed [not included]
/etc/cxref/cxref-cpp.defines changed [not included]

/* cxref-bomb.c */
#include <stdio.h>

int
f1 (a, b)
    int a, b;
{
    return a + b;
}

int
f2 (a, b)
    int a, b;
{
    return a * b;
}

int
f3 (a, b, f)
    int a, b;
    int (*f)(int, int);
/*    int f;*/
{
    return f(a, b);
}

int
main (argc, argv)
    int argc;
    char *argv[];
{
    int d = 1, e =2;
    int g, h;
    int (*fp)(int,int);

/*  g = f3(d, e, f1);
    h = f3(d, e, f2);*/


    fp = f1;
    g = fp(d, e);
    fp = f2;
    h = fp(d, e);

    printf ("d=%d e=%d d+e=g=%d d*e=h=%d\n", d, e, g, h);
    return 0;
}