Skip to content

fix oob tree index in parseClangAstDump on stray NULL node - #8903

Open
Nussu06 wants to merge 1 commit into
cppcheck-opensource:mainfrom
Nussu06:clangimport-null-node-bounds
Open

Nussu06 wants to merge 1 commit into
cppcheck-opensource:mainfrom
Nussu06:clangimport-null-node-bounds

Conversation

@Nussu06

@Nussu06 Nussu06 commented Sep 29, 2026

Copy link
Copy Markdown

parseClangAstDump indexes tree[level - 1] for a <<<NULL>>> line without the level == 0 || level > tree.size() check that the sibling path for normal nodes applies a few lines below, so a dump whose stray null child sits at the top indentation makes level zero and reads tree[-1]. Feeding a crafted or truncated clang AST dump through --clang trips a heap-buffer-overflow (confirmed under ASAN) in that loop. This adds the same guard the normal-node path already uses, plus a regression test next to the existing crash() case.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant