Skip to content

Commit e76739e

Browse files
authored
[libclang] Always Dup in createRef(StringRef) (llvm#125020)
We can't guaranty that underlying string is 0-terminated and [String.size()] is even in the same allocation. https://lab.llvm.org/buildbot/#/builders/94/builds/4152/steps/17/logs/stdio ``` ==c-index-test==1846256==WARNING: MemorySanitizer: use-of-uninitialized-value #0 in clang::cxstring::createRef(llvm::StringRef) llvm-project/clang/tools/libclang/CXString.cpp:96:36 #1 in DumpCXCommentInternal llvm-project/clang/tools/c-index-test/c-index-test.c:521:39 #2 in DumpCXCommentInternal llvm-project/clang/tools/c-index-test/c-index-test.c:674:7 #3 in DumpCXCommentInternal llvm-project/clang/tools/c-index-test/c-index-test.c:674:7 #4 in DumpCXComment llvm-project/clang/tools/c-index-test/c-index-test.c:685:3 #5 in PrintCursorComments llvm-project/clang/tools/c-index-test/c-index-test.c:768:7 Memory was marked as uninitialized #0 in __msan_allocated_memory llvm-project/compiler-rt/lib/msan/msan_interceptors.cpp:1023:5 #1 in Allocate llvm-project/llvm/include/llvm/Support/Allocator.h:172:7 #2 in Allocate llvm-project/llvm/include/llvm/Support/Allocator.h:216:12 #3 in Allocate llvm-project/llvm/include/llvm/Support/AllocatorBase.h:53:43 #4 in Allocate<char> llvm-project/llvm/include/llvm/Support/AllocatorBase.h:76:29 #5 in convertCodePointToUTF8 llvm-project/clang/lib/AST/CommentLexer.cpp:42:30 #6 in clang::comments::Lexer::resolveHTMLDecimalCharacterReference(llvm::StringRef) const llvm-project/clang/lib/AST/CommentLexer.cpp:76:10 ROCm#7 in clang::comments::Lexer::lexHTMLCharacterReference(clang::comments::Token&) llvm-project/clang/lib/AST/CommentLexer.cpp:615:16 ROCm#8 in consumeToken llvm-project/clang/include/clang/AST/CommentParser.h:62:9 ROCm#9 in clang::comments::Parser::parseParagraphOrBlockCommand() llvm-project/clang/lib/AST/CommentParser.cpp ROCm#10 in clang::comments::Parser::parseFullComment() llvm-project/clang/lib/AST/CommentParser.cpp:925:22 ROCm#11 in clang::RawComment::parse(clang::ASTContext const&, clang::Preprocessor const*, clang::Decl const*) const llvm-project/clang/lib/AST/RawCommentList.cpp:221:12 ROCm#12 in clang::ASTContext::getCommentForDecl(clang::Decl const*, clang::Preprocessor const*) const llvm-project/clang/lib/AST/ASTContext.cpp:714:35 ROCm#13 in clang_Cursor_getParsedComment llvm-project/clang/tools/libclang/CXComment.cpp:36:35 ROCm#14 in PrintCursorComments llvm-project/clang/tools/c-index-test/c-index-test.c:756:25 ```
1 parent 1032df6 commit e76739e

File tree

2 files changed

+4
-13
lines changed

2 files changed

+4
-13
lines changed

clang/docs/ReleaseNotes.rst

+3
Original file line numberDiff line numberDiff line change
@@ -252,6 +252,9 @@ clang-format
252252
libclang
253253
--------
254254

255+
- Fixed a buffer overflow in ``CXString`` implementation. The fix may result in
256+
increased memory allocation.
257+
255258
Code Completion
256259
---------------
257260

clang/tools/libclang/CXString.cpp

+1-13
Original file line numberDiff line numberDiff line change
@@ -87,19 +87,7 @@ CXString createRef(StringRef String) {
8787
if (String.empty())
8888
return createEmpty();
8989

90-
// If the string is not nul-terminated, we have to make a copy.
91-
92-
// FIXME: This is doing a one past end read, and should be removed! For memory
93-
// we don't manage, the API string can become unterminated at any time outside
94-
// our control.
95-
96-
if (String.data()[String.size()] != 0)
97-
return createDup(String);
98-
99-
CXString Result;
100-
Result.data = String.data();
101-
Result.private_flags = (unsigned) CXS_Unmanaged;
102-
return Result;
90+
return createDup(String);
10391
}
10492

10593
CXString createDup(StringRef String) {

0 commit comments

Comments
 (0)