From 636f0a88ed22547dff3af39457b670bcf6afd3fb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ludvig=20Gunne=20Lindstr=C3=B6m?=
 <ludviggunnelindstrom@gmail.com>
Date: Mon, 13 Jul 2026 13:19:35 +0200
Subject: [PATCH 1/4] fix typo in existing test

---
 test/testsimplifytypedef.cpp | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/test/testsimplifytypedef.cpp b/test/testsimplifytypedef.cpp
index 84a95a81cfc..0682d7a2f7f 100644
--- a/test/testsimplifytypedef.cpp
+++ b/test/testsimplifytypedef.cpp
@@ -3836,11 +3836,11 @@ class TestSimplifyTypedef : public TestFixture {
                            "}";
         ASSERT_EQUALS(exp, tok(code));
 
-        const char code2[] = "typedef stuct T* T;\n" // #14669
+        const char code2[] = "typedef struct T* T;\n" // #14669
                              "struct T {\n"
                              "    T p;\n"
                              "};\n";
-        const char exp2[] = "struct T { stuct T * p ; } ;";
+        const char exp2[] = "struct T { struct T * p ; } ;";
         ASSERT_EQUALS(exp2, simplifyTypedefC(code2));
     }
 

From 312d3fb49c3efbe29e28ad9cab1b57b266565039 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ludvig=20Gunne=20Lindstr=C3=B6m?=
 <ludviggunnelindstrom@gmail.com>
Date: Mon, 13 Jul 2026 13:19:30 +0200
Subject: [PATCH 2/4] add test

---
 test/testsimplifytypedef.cpp | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/test/testsimplifytypedef.cpp b/test/testsimplifytypedef.cpp
index 0682d7a2f7f..5a14399e406 100644
--- a/test/testsimplifytypedef.cpp
+++ b/test/testsimplifytypedef.cpp
@@ -233,6 +233,7 @@ class TestSimplifyTypedef : public TestFixture {
         TEST_CASE(simplifyTypedef160);
         TEST_CASE(simplifyTypedef161);
         TEST_CASE(simplifyTypedef162);
+        TEST_CASE(simplifyTypedef163);
 
         TEST_CASE(simplifyTypedefFunction1);
         TEST_CASE(simplifyTypedefFunction2); // ticket #1685
@@ -3868,6 +3869,11 @@ class TestSimplifyTypedef : public TestFixture {
         ASSERT_EQUALS(exp, tok(code));
     }
 
+    void simplifyTypedef163() {
+        const char code[] = "typedef v *v;";
+        ASSERT_THROW_INTERNAL(tok(code), INTERNAL);
+    }
+
     void simplifyTypedefFunction1() {
         {
             const char code[] = "typedef void (*my_func)();\n"

From 69a5065a67d05435550a3d231f95a2ee24c670ca Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ludvig=20Gunne=20Lindstr=C3=B6m?=
 <ludviggunnelindstrom@gmail.com>
Date: Mon, 13 Jul 2026 12:41:14 +0200
Subject: [PATCH 3/4] fix

---
 lib/tokenize.cpp | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/lib/tokenize.cpp b/lib/tokenize.cpp
index 4e00e0d184e..b40d64a060e 100644
--- a/lib/tokenize.cpp
+++ b/lib/tokenize.cpp
@@ -589,12 +589,27 @@ namespace {
                 }
             }
 
+            const auto checkForRecursion = [this]() {
+                if (Token::Match(mTypedefToken, "typedef %name% %name% ;"))
+                    return;
+                for (const Token *tok = mTypedefToken; tok != mEndToken; tok = tok->next()) {
+                    if (tok == mNameToken)
+                        continue;
+                    if (tok->str() != mNameToken->str())
+                        continue;
+                    if (Token::Match(tok->previous(), "struct|class|enum|union"))
+                        continue;
+                    throw InternalError(tok, "recursive typedef encountered");
+                }
+            };
+
             for (Token* type = start; Token::Match(type, "%name%|*|&|&&"); type = type->next()) {
                 if (type != start && Token::Match(type, "%name% ;") && !type->isStandardType()) {
                     mRangeType.first = start;
                     mRangeType.second = type;
                     mNameToken = type;
                     mEndToken = mNameToken->next();
+                    checkForRecursion();
                     return;
                 }
                 if (type != start && Token::Match(type, "%name% [")) {
@@ -609,6 +624,7 @@ namespace {
                     mEndToken = end->next();
                     mRangeAfterVar.first = mNameToken->next();
                     mRangeAfterVar.second = mEndToken;
+                    checkForRecursion();
                     return;
                 }
                 if (Token::Match(type->next(), "( * const| %name% ) (") && Token::simpleMatch(type->linkAt(1)->linkAt(1), ") ;")) {
@@ -618,6 +634,7 @@ namespace {
                     mRangeType.second = mNameToken;
                     mRangeAfterVar.first = mNameToken->next();
                     mRangeAfterVar.second = mEndToken;
+                    checkForRecursion();
                     return;
                 }
                 if (type != start && Token::Match(type, "%name% ( !!(") && Token::simpleMatch(type->linkAt(1), ") ;") && !type->isStandardType()) {
@@ -627,6 +644,7 @@ namespace {
                     mRangeType.second = type;
                     mRangeAfterVar.first = mNameToken->next();
                     mRangeAfterVar.second = mEndToken;
+                    checkForRecursion();
                     return;
                 }
             }

From d4520e18521e381bdb3dd827a385f38e7cdd876e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ludvig=20Gunne=20Lindstr=C3=B6m?=
 <ludviggunnelindstrom@gmail.com>
Date: Mon, 13 Jul 2026 13:22:22 +0200
Subject: [PATCH 4/4] add fuzz file

---
 .../timeout-242e02017d15d072fd7a230de22faeef0816693d             | 1 +
 1 file changed, 1 insertion(+)
 create mode 100644 test/cli/fuzz-timeout/timeout-242e02017d15d072fd7a230de22faeef0816693d

diff --git a/test/cli/fuzz-timeout/timeout-242e02017d15d072fd7a230de22faeef0816693d b/test/cli/fuzz-timeout/timeout-242e02017d15d072fd7a230de22faeef0816693d
new file mode 100644
index 00000000000..c269baf1efe
--- /dev/null
+++ b/test/cli/fuzz-timeout/timeout-242e02017d15d072fd7a230de22faeef0816693d
@@ -0,0 +1 @@
+typedef const v*v,*;
\ No newline at end of file