Conversation
| void nullNodeInvalidLevel() { | ||
| // a "<<<NULL>>>" line whose indentation maps to level 0 must not index tree[-1] | ||
| const char* clang = "`-FunctionDecl 0x1 <a.cpp:1:1, col:34> col:6 foo 'void ()'\n" | ||
| "`-<<<NULL>>>\n"; | ||
| ASSERT_EQUALS("void foo ( ) ;", parse(clang)); | ||
| } |
There was a problem hiding this comment.
This is an AI review. Take it with a grain of salt and feel free to reject it by resolving the comment.
The fix looks correct. I verified that nullNodeInvalidLevel fails on main (built with -D_GLIBCXX_ASSERTIONS: Assertion '__n < this->size()' failed on tree[level - 1]) and that TestClangImport passes with this PR.
Nit: the test function is defined between run() and the parse() helper. All the other test functions come after the helpers, and the description says it goes "next to the existing crash() case". Maybe move it to just after crash() at the end of the class?
There was a problem hiding this comment.
What is the status of ClangImport? As far as I see, it has been abandonded for years and is probably unusable. We might want to ditch it instead of wasting time on probably AI-generated "fixes".
3 participants
parseClangAstDump indexes tree[level - 1] for a
<<<NULL>>>line without thelevel == 0 || level > tree.size()check that the sibling path for normal nodes applies a few lines below, so a dump whose stray null child sits at the top indentation makes level zero and reads tree[-1]. Feeding a crafted or truncated clang AST dump through --clang trips a heap-buffer-overflow (confirmed under ASAN) in that loop. This adds the same guard the normal-node path already uses, plus a regression test next to the existing crash() case.