Skip to content

fix oob read in getSpelling when node has no ext tokens - #8907

Open
Nussu06 wants to merge 1 commit into
cppcheck-opensource:mainfrom
Nussu06:clangimport-getspelling-bounds
Open

Nussu06 wants to merge 1 commit into
cppcheck-opensource:mainfrom
Nussu06:clangimport-getspelling-bounds

Conversation

@Nussu06

@Nussu06 Nussu06 commented Oct 1, 2026

Copy link
Copy Markdown

getSpelling() sets typeIndex to mExtTokens.size() - 1 and, for node types other than the FunctionDecl and DeclRefExpr branches, reads mExtTokens[typeIndex - 1] without the typeIndex <= 0 check those two branches already apply. A clang AST dump whose node line carries no ext tokens leaves typeIndex at 0 or -1 (size() - 1 wraps into the int), so the read goes out of bounds, which ASAN flags as a SEGV while importing the dump via --clang. Hoist the existing guard ahead of the index so it covers every node type.

Comment thread lib/clangimport.cpp
Comment on lines +434 to +435
if (typeIndex <= 0)
return "";

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is an AI review. Take it with a grain of salt and feel free to reject it by resolving the comment.

The fix looks correct. I verified that the new crash2 test fails on main (built with -D_GLIBCXX_ASSERTIONS: Assertion '__n < this->size()' failed in getSpelling()) and passes with this PR.

The description says the guard is hoisted, but the two existing if (typeIndex <= 0) return ""; checks in the FunctionDecl/CXXConstructorDecl/CXXMethodDecl and DeclRefExpr branches above are kept. They are now redundant, since this new check covers them. Maybe remove them so there is only one guard? I tried that locally and TestClangImport still passes.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants