From 32775e5fbe9322ba8a3e85ed1750126aef5e9efb Mon Sep 17 00:00:00 2001
From: Guancheng Wang <24189100307@stu.xidian.edu.cn>
Date: Sat, 19 Sep 2026 06:20:57 +0800
Subject: [PATCH] smoke: handle allocation failure and NULL te_compile() result

Two robustness issues in the smoke test, both found with cppcheck/clang static analysis:

1. `test_deep_nesting()`-style depth tests `malloc()` the expression buffer and immediately memset/index it; on allocation failure this is a NULL dereference. Now records a failure via `lok(0)` and skips the case.
2. The equivalence test table calls `te_compile()` then dereferences the result right after `lok(ex)`; if compilation fails the test binary itself crashes instead of reporting a failed test. Now `continue`s after the failed `lok()` (still counted as a failure).

Full suite still passes after the change: 10080/10080 under ASan+UBSan.

Signed-off-by: warter666 <121139223+Warterkk@users.noreply.github.com>
---
 smoke.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/smoke.c b/smoke.c
index 51ad7cd..20d3097 100644
--- a/smoke.c
+++ b/smoke.c
@@ -565,6 +565,11 @@ void test_optimize() {
         int err;
         te_expr *ex = te_compile(expr, 0, 0, &err);
         lok(ex);
+        if (!ex) {
+            /* te_compile() failed: record the failure via lok() above and
+             * skip this case instead of dereferencing NULL. */
+            continue;
+        }
 
         /* The answer should be know without
          * even running eval. */
@@ -812,6 +817,10 @@ void test_depth() {
 
         /* ((((...1...)))) */
         char *expr = malloc(depth * 2 + 2);
+        if (!expr) {
+            lok(0);
+            continue;
+        }
         memset(expr, '(', depth);
         expr[depth] = '1';
         memset(expr + depth + 1, ')', depth);
@@ -823,6 +832,10 @@ void test_depth() {
 
         /* sin sin sin ... 1 */
         expr = malloc(depth * 4 + 2);
+        if (!expr) {
+            lok(0);
+            continue;
+        }
         for (j = 0; j < depth; ++j) memcpy(expr + j * 4, "sin ", 4);
         expr[depth * 4] = '1';
         expr[depth * 4 + 1] = '\0';