[clang] [clang] Fix a use-after-free in expression evaluation (PR #118480)

Ilya Biryukov via cfe-commits cfe-commits at lists.llvm.org
Thu Dec 12 05:43:32 PST 2024


ilya-biryukov wrote:

Here's a small reprocase (thanks for cvise for getting it):

```cpp
// Run under ASAN: clang -fsyntax-only <file>
template <class _InputIterator, class _Predicate>
constexpr _InputIterator find_if(_InputIterator __first, _Predicate __pred) {
  if (__pred(*__first))
    ;
}

template <class = char>
struct basic_string_view {
  char __data_;
};

template <typename T>
struct Span {
  T *begin;
};

constexpr Span<basic_string_view<char>> kNames((basic_string_view<char>[]){});

void StripConsentJoinIfNeeded() {
  !find_if(kNames.begin, [](basic_string_view<char>) { return true; });
}
```

Somebody would need to dig a little deeper to understand what's causing the crash here, but it should be manageable with this size. (I'd look at it myself, but probably not until next week)

https://github.com/llvm/llvm-project/pull/118480


More information about the cfe-commits mailing list