[PATCH 07/20] parse: Avoid incrementing rank on invalid long real specifiers

[Bart Van Assche <bvanassche@acm.org>]

Check whether rank is already non-zero before incrementing rank for a
Set_Long type specifier in declaration_specifiers(), and break out of the
loop before incrementing rank when class is CReal.

Prevent out-of-bounds reads past the end of real_types[] when indexing
types[class][rank] for invalid specifier combinations such as "long long
double", where incrementing rank to 2 before breaking exceeded the valid
[-1, 1] index range of real_types + 1.

Fixes: 319206abe1f2 ("Rewrite and fix specifiers handling")
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
 parse.c | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/parse.c b/parse.c
index 9389079eb173..0e3e384550c5 100644
--- a/parse.c
+++ b/parse.c
@@ -1595,14 +1595,17 @@ static struct token *declaration_specifiers(struct token *token, struct decl_sta
 				rank = -2;
 			if (s->op->set & (Set_Short|Set_Float)) {
 				rank = -1;
-			} else if (s->op->set & Set_Long && rank++) {
-				if (class == CReal) {
-					specifier_conflict(token->pos,
-							   Set_Vlong,
-							   &double_ident);
-					break;
+			} else if (s->op->set & Set_Long) {
+				if (rank) {
+					if (class == CReal) {
+						specifier_conflict(token->pos,
+								   Set_Vlong,
+								   &double_ident);
+						break;
+					}
+					seen |= Set_Vlong;
 				}
-				seen |= Set_Vlong;
+				rank++;
 			}
 		}
 		token = token->next;