[clang] [clangd][Parser][Sema] Fix TemplateIdAnnotation UAF with template-id … (PR #196788)

[via cfe-commits]

llvmorg-github-actions[bot] wrote:


<!--LLVM PR SUMMARY COMMENT-->

@llvm/pr-subscribers-clang

Author: Cheng Lingfei (clingfei)

<details>
<summary>Changes</summary>

…declarator and lambda default argument.

I think this is another case of template annotations lifetime bug, similar to the one fixed by https://github.com/llvm/llvm-project/pull/89494.

Closes https://github.com/llvm/llvm-project/issues/196725.

---
Full diff: https://github.com/llvm/llvm-project/pull/196788.diff


2 Files Affected:

- (modified) clang/lib/Parse/ParseDecl.cpp (+8) 
- (modified) clang/test/Parser/cxx-default-args.cpp (+6) 


``````````diff
diff --git a/clang/lib/Parse/ParseDecl.cpp b/clang/lib/Parse/ParseDecl.cpp
index 55ea562faacaa..1a04ca7f43647 100644
--- a/clang/lib/Parse/ParseDecl.cpp
+++ b/clang/lib/Parse/ParseDecl.cpp
@@ -7748,6 +7748,14 @@ void Parser::ParseParameterDeclarationClause(
           // Consume the '='.
           ConsumeToken();
 
+          // The default argument may contain a lambda whose body triggers
+          // MaybeDestroyTemplateIds at the end of the inner statements; avoid
+          // destroying parsed template-ids that may still be referenced by
+          // the enclosing declarator (e.g. a template-id in the function
+          // name or other parameters).
+          DelayTemplateIdDestructionRAII DontDestructTemplateIds(
+              *this, /*DelayTemplateIdDestruction=*/true);
+
           // The argument isn't actually potentially evaluated unless it is
           // used.
           EnterExpressionEvaluationContext Eval(
diff --git a/clang/test/Parser/cxx-default-args.cpp b/clang/test/Parser/cxx-default-args.cpp
index 5b7d22a56bb91..9fd9651031023 100644
--- a/clang/test/Parser/cxx-default-args.cpp
+++ b/clang/test/Parser/cxx-default-args.cpp
@@ -40,3 +40,9 @@ struct U {
   void i(int x = ) {} // expected-error{{expected expression}}
   typedef int *fp(int x = ); // expected-error{{default arguments can only be specified for parameters in a function declaration}}
 };
+
+namespace {
+void f<>(int = []{;}) {} // expected-error{{no viable conversion from}} \
+                         // expected-error{{template specialization requires 'template<>'}} \
+                         // expected-note 2{{}}
+}

``````````

</details>


https://github.com/llvm/llvm-project/pull/196788