[cfe-commits] r140427 - in /cfe/trunk: lib/Parse/ParseCXXInlineMethods.cpp test/Parser/cxx-member-init-missing-paren-crash.cpp

[Matt Beaumont-Gay]

Author: matthewbg
Date: Fri Sep 23 17:39:23 2011
New Revision: 140427

URL: http://llvm.org/viewvc/llvm-project?rev=140427&view=rev
Log:
Fix a crash-on-invalid.

The token stream was not getting properly reset when leaving
ParseLexedMethodDef in some error cases. In the testcase, that caused later
accesses to the token stream to touch memory which had been freed as we
finished parsing the class definition. Major hat-tip to AddressSanitizer for
helping pinpoint the use-after-free, including the allocation and deallocation
points:

==21510== ERROR: AddressSanitizer heap-use-after-free on address 0x7feb3de87848 at pc 0x249f4e2 bp 0x7fff15a89df0 sp 0x7fff15a89ce0
READ of size 1 at 0x7feb3de87848 thread T0
  #0 0x249f4e2 clang::TokenLexer::Lex()
  #1 0x1c834a0 clang::Parser::ConsumeToken()
  #2 0x1c7dc0f clang::Parser::ParseDeclarationOrFunctionDefinition()
  #3 0x1c7e16b clang::Parser::ParseDeclarationOrFunctionDefinition()
<snip>
0x7feb3de87848 is located 1992 bytes inside of 3816-byte region [0x7feb3de87080,0x7feb3de87f68)
freed by thread T0 here:
  #0 0x3a22c19 free
  #1 0x1d136a1 clang::Parser::LexedMethod::~LexedMethod()
  #2 0x1cef528 clang::Parser::DeallocateParsedClasses()
  #3 0x1cef676 clang::Parser::PopParsingClass()
  #4 0x1cea094 clang::Parser::ParseCXXMemberSpecification()
  #5 0x1ce7ae5 clang::Parser::ParseClassSpecifier()
  #6 0x1cfe588 clang::Parser::ParseDeclarationSpecifiers()
  #7 0x1c7dbe8 clang::Parser::ParseDeclarationOrFunctionDefinition()
  #8 0x1c7e16b clang::Parser::ParseDeclarationOrFunctionDefinition()
<snip>
previously allocated by thread T0 here:
  #0 0x3a2302d realloc
  #1 0x39d7c97 llvm::SmallVectorBase::grow_pod()
  #2 0x1ac588e llvm::SmallVectorImpl<>::push_back()
  #3 0x1d12d8b clang::Parser::ConsumeAndStoreUntil()
  #4 0x1c9c24d clang::Parser::ConsumeAndStoreUntil()
  #5 0x1d12c1e clang::Parser::ConsumeAndStoreUntil()
  #6 0x1c9c24d clang::Parser::ConsumeAndStoreUntil()
  #7 0x1d10042 clang::Parser::ParseCXXInlineMethodDef()
  #8 0x1cec51a clang::Parser::ParseCXXClassMemberDeclaration()
  #9 0x1ce9de5 clang::Parser::ParseCXXMemberSpecification()
  #10 0x1ce7ae5 clang::Parser::ParseClassSpecifier()
  #11 0x1cfe588 clang::Parser::ParseDeclarationSpecifiers()
  #12 0x1c7dbe8 clang::Parser::ParseDeclarationOrFunctionDefinition()
  #13 0x1c7e16b clang::Parser::ParseDeclarationOrFunctionDefinition()
<snip>

Added:
    cfe/trunk/test/Parser/cxx-member-init-missing-paren-crash.cpp
Modified:
    cfe/trunk/lib/Parse/ParseCXXInlineMethods.cpp

Modified: cfe/trunk/lib/Parse/ParseCXXInlineMethods.cpp
URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/lib/Parse/ParseCXXInlineMethods.cpp?rev=140427&r1=140426&r2=140427&view=diff
==============================================================================
--- cfe/trunk/lib/Parse/ParseCXXInlineMethods.cpp (original)
+++ cfe/trunk/lib/Parse/ParseCXXInlineMethods.cpp Fri Sep 23 17:39:23 2011
@@ -398,6 +398,8 @@
     if (!Tok.is(tok::l_brace)) {
       FnScope.Exit();
       Actions.ActOnFinishFunctionBody(LM.D, 0);
+      while (Tok.getLocation() != origLoc && Tok.isNot(tok::eof))
+        ConsumeAnyToken();
       return;
     }
   } else

Added: cfe/trunk/test/Parser/cxx-member-init-missing-paren-crash.cpp
URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/test/Parser/cxx-member-init-missing-paren-crash.cpp?rev=140427&view=auto
==============================================================================
--- cfe/trunk/test/Parser/cxx-member-init-missing-paren-crash.cpp (added)
+++ cfe/trunk/test/Parser/cxx-member-init-missing-paren-crash.cpp Fri Sep 23 17:39:23 2011
@@ -0,0 +1,12 @@
+// RUN: not %clang_cc1 -fsyntax-only %s
+// Note: The important part here is that we don't crash, not any specific errors
+class Test {
+ public:
+  Test() : ab_(false {};
+
+  bool ab() {
+    return ab_;
+  }
+ private:
+  bool ab_;
+}