From a3c8020f7284ce0ddf88ce6b9972047c7d57199e Mon Sep 17 00:00:00 2001
From: nussaiba shaikh <nussaibah@bugqore.com>
Date: Thu, 1 Oct 2026 13:24:26 +0530
Subject: [PATCH 1/2] fix oob read in getSpelling when node has no ext tokens

---
 lib/clangimport.cpp      | 2 ++
 test/testclangimport.cpp | 8 ++++++++
 2 files changed, 10 insertions(+)

diff --git a/lib/clangimport.cpp b/lib/clangimport.cpp
index 98c0e700d83..64dc064569e 100644
--- a/lib/clangimport.cpp
+++ b/lib/clangimport.cpp
@@ -431,6 +431,8 @@ std::string clangimport::AstNode::getSpelling() const
         if (typeIndex <= 0)
             return "";
     }
+    if (typeIndex <= 0)
+        return "";
     const std::string &str = mExtTokens[typeIndex - 1];
     if (startsWith(str,"col:"))
         return "";
diff --git a/test/testclangimport.cpp b/test/testclangimport.cpp
index 6a39b563982..229e4c3c982 100644
--- a/test/testclangimport.cpp
+++ b/test/testclangimport.cpp
@@ -139,6 +139,7 @@ class TestClangImport : public TestFixture {
         TEST_CASE(valueType2);
 
         TEST_CASE(crash);
+        TEST_CASE(crash2);
     }
 
     std::string parse(const char clang[]) {
@@ -1372,6 +1373,13 @@ class TestClangImport : public TestFixture {
                             "  `-CompoundStmt 0x5603791b5700 <col:54, col:55>\n";
         (void)parse(clang); // don't crash
     }
+
+    void crash2() {
+        // getSpelling() indexed mExtTokens[typeIndex - 1] without a lower-bound
+        // check, so a node whose line carries no ext tokens (typeIndex <= 0) read
+        // out of bounds.
+        (void)parse("`-RecordDecl "); // don't crash
+    }
 };
 
 REGISTER_TEST(TestClangImport)

From 9781751b103810ce0c357f7df0eb1b3253e5cf63 Mon Sep 17 00:00:00 2001
From: nussaiba shaikh <nussaibah@bugqore.com>
Date: Fri, 2 Oct 2026 18:55:25 +0530
Subject: [PATCH 2/2] clangimport: drop redundant per-branch typeIndex guards
 in getSpelling

---
 lib/clangimport.cpp | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/lib/clangimport.cpp b/lib/clangimport.cpp
index 64dc064569e..f9520aba4b2 100644
--- a/lib/clangimport.cpp
+++ b/lib/clangimport.cpp
@@ -422,14 +422,10 @@ std::string clangimport::AstNode::getSpelling() const
     if (nodeType == FunctionDecl || nodeType == CXXConstructorDecl || nodeType == CXXMethodDecl) {
         while (typeIndex >= 0 && mExtTokens[typeIndex][0] != '\'')
             typeIndex--;
-        if (typeIndex <= 0)
-            return "";
     }
     if (nodeType == DeclRefExpr) {
         while (typeIndex > 0 && std::isalpha(mExtTokens[typeIndex][0]))
             typeIndex--;
-        if (typeIndex <= 0)
-            return "";
     }
     if (typeIndex <= 0)
         return "";