[clang] fix use after free in clang/tools/c-index-test/c-index-test.c #127063
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
recent change e76739e has exposed use after free in GetCursorSource() function that returned pointer to a disposed CXString
|
@llvm/pr-subscribers-clang Author: Mikhail Goncharov (metaflow) Changesrecent change e76739e has exposed Full diff: https://github.com/llvm/llvm-project/pull/127063.diff 1 Files Affected:
diff --git a/clang/tools/c-index-test/c-index-test.c b/clang/tools/c-index-test/c-index-test.c
index a9d8261bd03e7..fed6fe0736904 100644
--- a/clang/tools/c-index-test/c-index-test.c
+++ b/clang/tools/c-index-test/c-index-test.c
@@ -1213,7 +1213,21 @@ static void PrintCursor(CXCursor Cursor, const char *CommentSchemaFile) {
}
}
-static const char* GetCursorSource(CXCursor Cursor) {
+static CXString createCXString(const char *CS) {
+ CXString Str;
+ Str.data = (const void *)CS;
+ Str.private_flags = 0;
+ return Str;
+}
+
+static CXString duplicateCXString(const char *CS) {
+ CXString Str;
+ Str.data = strdup(CS);
+ Str.private_flags = 1; // CXS_Malloc
+ return Str;
+}
+
+static CXString GetCursorSource(CXCursor Cursor) {
CXSourceLocation Loc = clang_getCursorLocation(Cursor);
CXString source;
CXFile file;
@@ -1221,20 +1235,12 @@ static const char* GetCursorSource(CXCursor Cursor) {
source = clang_getFileName(file);
if (!clang_getCString(source)) {
clang_disposeString(source);
- return "<invalid loc>";
+ return createCXString("<invalid loc>");
}
- else {
- const char *b = basename(clang_getCString(source));
- clang_disposeString(source);
- return b;
- }
-}
-
-static CXString createCXString(const char *CS) {
- CXString Str;
- Str.data = (const void *) CS;
- Str.private_flags = 0;
- return Str;
+ const char *b = basename(clang_getCString(source));
+ CXString result = duplicateCXString(b);
+ clang_disposeString(source);
+ return result;
}
/******************************************************************************/
@@ -1358,8 +1364,10 @@ enum CXChildVisitResult FilteredPrintingVisitor(CXCursor Cursor,
CXSourceLocation Loc = clang_getCursorLocation(Cursor);
unsigned line, column;
clang_getFileLocation(Loc, 0, &line, &column, 0);
- printf("// %s: %s:%d:%d: ", FileCheckPrefix,
- GetCursorSource(Cursor), line, column);
+ CXString source = GetCursorSource(Cursor);
+ printf("// %s: %s:%d:%d: ", FileCheckPrefix, clang_getCString(source), line,
+ column);
+ clang_disposeString(source);
PrintCursor(Cursor, Data->CommentSchemaFile);
PrintCursorExtent(Cursor);
if (clang_isDeclaration(Cursor.kind)) {
@@ -1428,8 +1436,10 @@ static enum CXChildVisitResult FunctionScanVisitor(CXCursor Cursor,
if (Ref.kind == CXCursor_NoDeclFound) {
/* Nothing found here; that's fine. */
} else if (Ref.kind != CXCursor_FunctionDecl) {
- printf("// %s: %s:%d:%d: ", FileCheckPrefix, GetCursorSource(Ref),
- curLine, curColumn);
+ CXString CursorSource = GetCursorSource(Ref);
+ printf("// %s: %s:%d:%d: ", FileCheckPrefix,
+ clang_getCString(CursorSource), curLine, curColumn);
+ clang_disposeString(CursorSource);
PrintCursor(Ref, Data->CommentSchemaFile);
printf("\n");
}
@@ -1455,7 +1465,10 @@ enum CXChildVisitResult USRVisitor(CXCursor C, CXCursor parent,
clang_disposeString(USR);
return CXChildVisit_Recurse;
}
- printf("// %s: %s %s", FileCheckPrefix, GetCursorSource(C), cstr);
+ CXString CursorSource = GetCursorSource(C);
+ printf("// %s: %s %s", FileCheckPrefix, clang_getCString(CursorSource),
+ cstr);
+ clang_disposeString(CursorSource);
PrintCursorExtent(C);
printf("\n");
|
|
LLVM Buildbot has detected a new failure on builder Full details are available at: https://lab.llvm.org/buildbot/#/builders/51/builds/11113 Here is the relevant piece of the build log for the reference |
|
@metaflow @vitalybuka I've checked in 8f41d28 to fix warnings. Thanks! |
Thank You! |
|
LLVM Buildbot has detected a new failure on builder Full details are available at: https://lab.llvm.org/buildbot/#/builders/66/builds/10094 Here is the relevant piece of the build log for the reference |
|
LLVM Buildbot has detected a new failure on builder Full details are available at: https://lab.llvm.org/buildbot/#/builders/168/builds/8866 Here is the relevant piece of the build log for the reference |
|
LLVM Buildbot has detected a new failure on builder Full details are available at: https://lab.llvm.org/buildbot/#/builders/72/builds/8367 Here is the relevant piece of the build log for the reference |
vitalybuka
added a commit
that referenced
this pull request
Feb 20, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
recent change e76739e has exposed
use after free in GetCursorSource() function that returned pointer to
a disposed CXString