[PATCH] D42043: c-index: CXString: fix MSAN read-past-end bug

Steve O'Brien via Phabricator via cfe-commits cfe-commits at lists.llvm.org
Thu Jan 18 20:27:48 PST 2018

elsteveogrande updated this revision to Diff 130556.
elsteveogrande marked an inline comment as done.
elsteveogrande added a comment.

Fixes, but first, a question for reviewers:

Looking at the description of `clang_disposeString`:

   * \brief Free the given string.
  CINDEX_LINKAGE void clang_disposeString(CXString string);

Does it seem incorrect to acquire some `const char *` pointer into this string, dispose the string, and then access the characters?

I've seen this happen a couple of times now.  As I make changes to my code I run into this pattern.  (Since now this triggers a use-after-free abort.)

I wanted to ask because, though it seemed obvious to me that this is incorrect usage, I'm now wondering if the expectation is that it's ok.  Or maybe wasn't technically ok, and we just "got away with it" before.  :)

Anyway, assuming it's only correct to use the string before disposing it, then the fixes this time around are:

- Fix an ASAN use-after-free in `c-index-test` mentioned above.  Get the `CXString`, pass it around, then dispose when we're done with it.
- Change `createEmpty` and `createNull` to delegate through `createRef`
- `createRef` tolerates `nullptr` correctly.
- I previously ran into ASAN aborts due to mixing malloc/free/operator new/delete.  I had changed everything to use operator new/delete.  However from C-land I can't `new char[length]`, only `malloc` (or `strdup` or whatever).  Change everything to malloc/free instead.

  rC Clang



-------------- next part --------------
A non-text attachment was scrubbed...
Name: D42043.130556.patch
Type: text/x-patch
Size: 32368 bytes
Desc: not available
URL: <http://lists.llvm.org/pipermail/cfe-commits/attachments/20180119/46a8ce84/attachment-0001.bin>

More information about the cfe-commits mailing list