Skip to content

clang import: reject AST nodes without the ext tokens the handlers read #8948

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Nussu06 wants to merge 2 commits into
base: main
Choose a base branch
from
+37 −5
Open

clang import: reject AST nodes without the ext tokens the handlers read #8948

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
e267a95
clang import: reject AST nodes without the ext tokens the handlers read
Nussu06 Oct 18, 2026
24d64ec
clang import: reject address-only function and enumerator declarations
Nussu06 Oct 19, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 19 additions & 4 deletions lib/clangimport.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -336,7 +336,10 @@ namespace clangimport {
public:
AstNode(std::string nodeType, const std::string &ext, Data *data)
: nodeType(std::move(nodeType)), mExtTokens(splitString(ext)), mData(data)
{}
{
if (mExtTokens.empty())
throw InternalError(nullptr, "invalid AST node: " + this->nodeType, InternalError::AST);
}
std::string nodeType;
std::vector<AstNodePtr> children;

Expand Down Expand Up @@ -1052,7 +1055,10 @@ Token *clangimport::AstNode::createTokens(TokenList &tokenList)
return nullptr;
}
if (nodeType == EnumConstantDecl) {
Token *nameToken = addtoken(tokenList, getSpelling());
const std::string name = getSpelling();
if (name.empty())
throw InternalError(nullptr, "invalid AST node: " + nodeType, InternalError::AST);
Token *nameToken = addtoken(tokenList, name);
auto *scope = const_cast<Scope *>(nameToken->scope());
scope->enumeratorList.emplace_back(nameToken->scope());
Enumerator *e = &scope->enumeratorList.back();
Expand Down Expand Up @@ -1383,6 +1389,10 @@ Token * clangimport::AstNode::createTokensCall(TokenList &tokenList)

void clangimport::AstNode::createTokensFunctionDecl(TokenList &tokenList)
{
// an address-only node has no name: addtoken("") adds nothing and would return a null back()
const std::string name = getSpelling();
if (name.empty())
throw InternalError(nullptr, "invalid AST node: " + nodeType, InternalError::AST);
const bool prev = contains(mExtTokens, "prev");
const bool hasBody = !children.empty() && children.back()->nodeType == CompoundStmt;
const bool isStatic = contains(mExtTokens, "static");
Expand All @@ -1404,11 +1414,14 @@ void clangimport::AstNode::createTokensFunctionDecl(TokenList &tokenList)
if (mExtTokens.size() > 4 && mExtTokens[1] == "parent")
addFullScopeNameTokens(tokenList, mData->getScope(mExtTokens[2]));

Token *nameToken = addtoken(tokenList, getSpelling() + getTemplateParameters());
Token *nameToken = addtoken(tokenList, name + getTemplateParameters());
auto *nestedIn = const_cast<Scope *>(nameToken->scope());

if (prev) {
const std::string addr = *(std::find(mExtTokens.cbegin(), mExtTokens.cend(), "prev") + 1);
const auto it = std::find(mExtTokens.cbegin(), mExtTokens.cend(), "prev");
if (it + 1 == mExtTokens.cend())
throw InternalError(nullptr, "invalid AST node: " + nodeType, InternalError::AST);
const std::string addr = *(it + 1);
mData->ref(addr, nameToken);
}
if (!nameToken->function()) {
Expand Down Expand Up @@ -1549,6 +1562,8 @@ void clangimport::AstNode::createTokensForCXXRecord(TokenList &tokenList)

Token * clangimport::AstNode::createTokensVarDecl(TokenList &tokenList)
{
if (mExtTokens.size() < 2)

@dmcppcheck dmcppcheck Oct 19, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

AI review

size() < 2 doesn't cover the two-token case. For `-VarDecl 0x1 'int' the loop below stops at typeIndex == 1, so name = mExtTokens[0] is the address 0x1. addtoken("0x1") creates a number token, and varDecl() then gives it a varId, which fails the assertion at token.cpp:195:

TranslationUnitDecl 0x0 <<invalid sloc>> <invalid sloc>
`-VarDecl 0x1 'int'

cppcheck: lib/token.cpp:195: void Token::update_property_info(): Assertion `!mImpl->mVarId || mTokType == eVariable' failed.

0x1 <col:1> and FieldDecl 0x1 'int' abort the same way. Throwing when typeIndex < 2 after the loop (that is, when there is no name token between the address and the type) would also cover the address-only case.

throw InternalError(nullptr, "invalid AST node: " + nodeType, InternalError::AST);
const std::string addr = mExtTokens.front();
if (contains(mExtTokens, "static"))
addtoken(tokenList, "static");
Expand Down
19 changes: 18 additions & 1 deletion test/testclangimport.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -143,6 +143,7 @@ class TestClangImport : public TestFixture {
TEST_CASE(crash);
TEST_CASE(crash2);
TEST_CASE(nullNodeInvalidLevel);
TEST_CASE(invalidExtTokens);
}

std::string parse(const char clang[]) {
Expand Down Expand Up @@ -1420,7 +1421,7 @@ class TestClangImport : public TestFixture {
// getSpelling() indexed mExtTokens[typeIndex - 1] without a lower-bound
// check, so a node whose line carries no ext tokens (typeIndex <= 0) read
// out of bounds.
(void)parse("`-RecordDecl "); // don't crash
ASSERT_THROW_INTERNAL_EQUALS(parse("`-RecordDecl "), AST, "invalid AST node: RecordDecl");
}

void nullNodeInvalidLevel() {
Expand All @@ -1429,6 +1430,22 @@ class TestClangImport : public TestFixture {
"`-<<<NULL>>>\n";
ASSERT_EQUALS("void foo ( ) ;", parse(clang));
}

void invalidExtTokens() {
// nodes without the ext tokens the handlers read must not index out of bounds
ASSERT_THROW_INTERNAL_EQUALS(parse("`-FunctionDecl 0x1 <a.cpp:1:1, col:20> col:5 f 'int ()'\n"
" `-CompoundStmt 0x2 <col:9, col:20>\n"
" `-ReturnStmt 0x3 <col:11, col:18>\n"
" `-IntegerLiteral \n"), AST, "invalid AST node: IntegerLiteral");
ASSERT_THROW_INTERNAL_EQUALS(parse("`-EnumDecl "), AST, "invalid AST node: EnumDecl");
ASSERT_THROW_INTERNAL_EQUALS(parse("`-VarDecl 0x1"), AST, "invalid AST node: VarDecl");
ASSERT_THROW_INTERNAL_EQUALS(parse("`-FunctionDecl 0x1 <a.cpp:1:1, col:20> col:5 f 'int ()' prev"), AST, "invalid AST node: FunctionDecl");
// address-only declarations: getSpelling() is empty, addtoken() adds nothing and back() is null
ASSERT_THROW_INTERNAL_EQUALS(parse("`-FunctionDecl 0x1"), AST, "invalid AST node: FunctionDecl");
ASSERT_THROW_INTERNAL_EQUALS(parse("`-CXXConstructorDecl 0x1"), AST, "invalid AST node: CXXConstructorDecl");
ASSERT_THROW_INTERNAL_EQUALS(parse("`-CXXMethodDecl 0x1"), AST, "invalid AST node: CXXMethodDecl");
ASSERT_THROW_INTERNAL_EQUALS(parse("`-EnumConstantDecl 0x1"), AST, "invalid AST node: EnumConstantDecl");
}
};

REGISTER_TEST(TestClangImport)
Loading