<html>
    <head>
      <base href="http://llvm.org/bugs/" />
    </head>
    <body><table border="1" cellspacing="0" cellpadding="8">
        <tr>
          <th>Bug ID</th>
          <td><a class="bz_bug_link 
          bz_status_NEW "
   title="NEW --- - clang: heap-buffer-overflow on invalid input with unicode in clang::Lexer::LexAngledStringLiteral"
   href="http://llvm.org/bugs/show_bug.cgi?id=22407">22407</a>
          </td>
        </tr>

        <tr>
          <th>Summary</th>
          <td>clang: heap-buffer-overflow on invalid input with unicode in clang::Lexer::LexAngledStringLiteral
          </td>
        </tr>

        <tr>
          <th>Product</th>
          <td>new-bugs
          </td>
        </tr>

        <tr>
          <th>Version</th>
          <td>unspecified
          </td>
        </tr>

        <tr>
          <th>Hardware</th>
          <td>PC
          </td>
        </tr>

        <tr>
          <th>OS</th>
          <td>Linux
          </td>
        </tr>

        <tr>
          <th>Status</th>
          <td>NEW
          </td>
        </tr>

        <tr>
          <th>Severity</th>
          <td>normal
          </td>
        </tr>

        <tr>
          <th>Priority</th>
          <td>P
          </td>
        </tr>

        <tr>
          <th>Component</th>
          <td>new bugs
          </td>
        </tr>

        <tr>
          <th>Assignee</th>
          <td>unassignedbugs@nondot.org
          </td>
        </tr>

        <tr>
          <th>Reporter</th>
          <td>kcc@google.com
          </td>
        </tr>

        <tr>
          <th>CC</th>
          <td>llvmbugs@cs.uiuc.edu
          </td>
        </tr>

        <tr>
          <th>Classification</th>
          <td>Unclassified
          </td>
        </tr></table>
      <p>
        <div>
        <pre>Created <span class=""><a href="attachment.cgi?id=13776" name="attach_13776" title="reproducer">attachment 13776</a> <a href="attachment.cgi?id=13776&action=edit" title="reproducer">[details]</a></span>
reproducer

Found with fuzzing...

$ clang -cc1 hbo.cc

READ of size 1 at 0x60e00000dc79 thread T0
    #0 0xb70b6fb in getAndAdvanceChar
tools/clang/include/clang/Lex/Lexer.h:529:36
    #1 0xb70b6fb in clang::Lexer::LexAngledStringLiteral(clang::Token&, char
const*) tools/clang/lib/Lex/Lexer.cpp:1876
    #2 0xb728647 in clang::Lexer::LexTokenInternal(clang::Token&, bool)
tools/clang/lib/Lex/Lexer.cpp:3393:14
    #3 0xb97d3d9 in clang::Preprocessor::Lex(clang::Token&)
tools/clang/lib/Lex/Preprocessor.cpp:692:23
    #4 0xb983202 in clang::PreprocessorLexer::LexIncludeFilename(clang::Token&)
tools/clang/lib/Lex/PreprocessorLexer.cpp:44:5
    #5 0xb84a845 in
clang::Preprocessor::HandleIncludeDirective(clang::SourceLocation,
clang::Token&, clang::DirectoryLookup const*, clang::FileEntry const*, bool)»
    #6 0xb83d85e in clang::Preprocessor::HandleDirective(clang::Token&)
tools/clang/lib/Lex/PPDirectives.cpp:853:14
    #7 0xb72fe86 in clang::Lexer::LexTokenInternal(clang::Token&, bool)
tools/clang/lib/Lex/Lexer.cpp:3639:3
    #8 0xb97d3d9 in clang::Preprocessor::Lex(clang::Token&)
tools/clang/lib/Lex/Preprocessor.cpp:692:23
    #9 0x7aa82fa in ConsumeToken tools/clang/include/clang/Parse/Parser.h:285:5


0x60e00000dc79 is located 0 bytes to the right of 153-byte region
[0x60e00000dbe0,0x60e00000dc79)
allocated by thread T0 here:
    #0 0x8048fb in operator new(unsigned long, std::nothrow_t const&)
projects/compiler-rt/lib/asan/asan_new_delete.cc:67:3
    #1 0x4cfc483 in getNewUninitMemBuffer lib/Support/MemoryBuffer.cpp:140:34
    #2 0x4cfc483 in getOpenFileImpl(int, llvm::Twine const&, unsigned long,
unsigned long, long, bool, bool) lib/Support/MemoryBuffer.cpp:369
    #3 0x4cfbb0c in llvm::MemoryBuffer::getOpenFile(int, llvm::Twine const&,
unsigned long, bool, bool) lib/Support/MemoryBuffer.cpp:410:10
    #4 0x53610f1 in (anonymous namespace)::RealFile::getBuffer(llvm::Twine
const&, long, bool, bool) tools/clang/lib/Basic/VirtualFileSystem.cpp:124:10
    #5 0x533b4dc in clang::FileManager::getBufferForFile(clang::FileEntry
const*, bool, bool) tools/clang/lib/Basic/FileManager.cpp:416:9
    #6 0x52d409d in
clang::SrcMgr::ContentCache::getBuffer(clang::DiagnosticsEngine&,
clang::SourceManager const&, clang::SourceLocation, bool*) const tools/clang/»
    #7 0xb8abe42 in clang::SourceManager::getBuffer(clang::FileID,
clang::SourceLocation, bool*) const
tools/clang/include/clang/Basic/SourceManager.h:887:12
    #8 0xb8a8a06 in clang::Preprocessor::EnterSourceFile(clang::FileID,
clang::DirectoryLookup const*, clang::SourceLocation)
tools/clang/lib/Lex/PPLexerChange.cpp»
    #9 0xb976ce9 in clang::Preprocessor::EnterMainSourceFile()
tools/clang/lib/Lex/Preprocessor.cpp:490:5
    #10 0x7a9e4b8 in clang::ParseAST(clang::Sema&, bool, bool)
tools/clang/lib/Parse/ParseAST.cpp:122:3</pre>
        </div>
      </p>
      <hr>
      <span>You are receiving this mail because:</span>
      
      <ul>
          <li>You are on the CC list for the bug.</li>
      </ul>
    </body>
</html>