[PATCH] D127105: [analyzer] Fix null pointer deref in CastValueChecker

Vince Bridgers via Phabricator via cfe-commits cfe-commits at lists.llvm.org
Tue Jun 7 05:43:30 PDT 2022


vabridgers added inline comments.


================
Comment at: clang/lib/StaticAnalyzer/Checkers/CastValueChecker.cpp:168
-            CastToTy->getAsCXXRecordDecl()->getNameAsString() :
-            CastToTy->getPointeeCXXRecordDecl()->getNameAsString();
           Out << ' ' << ((CastToTyVec.size() == 1) ? "not" :
----------------
steakhal wrote:
> So this was null, right?  Which caused the crash.
Yes, the call to "CastToTy->getPointeeCXXRecordDecl()" returned nullptr, which was then used to dereference getNameAsString(), then boom :) 


================
Comment at: clang/test/Analysis/cast-value-notes.cpp:306
+
+// don't crash
+namespace llvm {
----------------
steakhal wrote:
> It's good to know which line exactly caused the crash. Put this note right there.
Will address, thank you


================
Comment at: clang/test/Analysis/cast-value-notes.cpp:311
+public:
+  template <typename> void b() { isa<int>(*this); }
+};
----------------
steakhal wrote:
> This gotta be the `getAs<T>`. Please try to reconstruct the 'feel' of it; like return a `T*` instead of `void` etc.
I'll attempt a further simplification. This was the product of a very long and tedious manual and creduce reduction process from a 12M preprocessed file :/


Repository:
  rG LLVM Github Monorepo

CHANGES SINCE LAST ACTION
  https://reviews.llvm.org/D127105/new/

https://reviews.llvm.org/D127105



More information about the cfe-commits mailing list