Skip to content

Fix segfault in getLifetimeVariable#1631

Closed
serval2412 wants to merge 2 commits into
cppcheck-opensource:masterfrom
serval2412:master
Closed

Fix segfault in getLifetimeVariable#1631
serval2412 wants to merge 2 commits into
cppcheck-opensource:masterfrom
serval2412:master

Conversation

@serval2412
Copy link
Copy Markdown

prevent infinite recursion, eg from LibreOffice
0 0x0000555555bdc9dd in multiComparePercent (tok=0x5555570916d0, haystack=@0x7fffff7ff0a0: 0x555555d20dd9 "%name% (",
varid=<error reading variable: Cannot access memory at address 0x7fffff7feffc>) at lib/token.cpp:354
1 0x0000555555bdd113 in Token::multiCompare (tok=0x5555570916d0, haystack=0x555555d20dd9 "%name% (", varid=0) at lib/token.cpp:499
2 0x0000555555bdd6c9 in Token::Match (tok=0x5555570916d0, pattern=0x555555d20dd9 "%name% (", varid=0) at lib/token.cpp:663
3 0x0000555555c62101 in getLifetimeVariable (tok=0x5555570921a0, errorPath=empty std::__debug::list) at lib/valueflow.cpp:2651
4 0x0000555555c62194 in getLifetimeVariable (tok=0x5555570921a0, errorPath=empty std::__debug::list) at lib/valueflow.cpp:2660
5 0x0000555555c62194 in getLifetimeVariable (tok=0x5555570921a0, errorPath=empty std::__debug::list) at lib/valueflow.cpp:2660

prevent infinite recursion, eg from LibreOffice
0  0x0000555555bdc9dd in multiComparePercent (tok=0x5555570916d0, haystack=@0x7fffff7ff0a0: 0x555555d20dd9 "%name% (",
   varid=<error reading variable: Cannot access memory at address 0x7fffff7feffc>) at lib/token.cpp:354
1  0x0000555555bdd113 in Token::multiCompare (tok=0x5555570916d0, haystack=0x555555d20dd9 "%name% (", varid=0) at lib/token.cpp:499
2  0x0000555555bdd6c9 in Token::Match (tok=0x5555570916d0, pattern=0x555555d20dd9 "%name% (", varid=0) at lib/token.cpp:663
3  0x0000555555c62101 in getLifetimeVariable (tok=0x5555570921a0, errorPath=empty std::__debug::list) at lib/valueflow.cpp:2651
4  0x0000555555c62194 in getLifetimeVariable (tok=0x5555570921a0, errorPath=empty std::__debug::list) at lib/valueflow.cpp:2660
5  0x0000555555c62194 in getLifetimeVariable (tok=0x5555570921a0, errorPath=empty std::__debug::list) at lib/valueflow.cpp:2660
Copy link
Copy Markdown
Collaborator

@orbitcowboy orbitcowboy left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Many thanks! Could you please add a regression test?

@serval2412
Copy link
Copy Markdown
Author

@orbitcowboy: don't have time to this but you may read some details about the bug here:
http://document-foundation-mail-archive.969070.n3.nabble.com/CppCheck-Report-Failure-td4256636.html

Also, I hesitated between "return nullptr;" and "return var;"
(I must recognize I didn't test first one but perhaps I should)

@pfultz2
Copy link
Copy Markdown
Contributor

pfultz2 commented Jan 28, 2019

I think return var is fine. A reduced test case for this:

int& f() { return f(); }

Which this PR does fix. Although, it will still crash on:

int& g(int& i) { return i; }
int& f() { return g(f()); }

I can try to fix that case.

@serval2412
Copy link
Copy Markdown
Author

Thank you Paul for your feedback.
Don't hesitate to push a fix, I'll remove my pullrequest.

prevent infinite recursion, eg from LibreOffice
0  0x0000555555bdc9dd in multiComparePercent (tok=0x5555570916d0, haystack=@0x7fffff7ff0a0: 0x555555d20dd9 "%name% (",
   varid=<error reading variable: Cannot access memory at address 0x7fffff7feffc>) at lib/token.cpp:354
1  0x0000555555bdd113 in Token::multiCompare (tok=0x5555570916d0, haystack=0x555555d20dd9 "%name% (", varid=0) at lib/token.cpp:499
2  0x0000555555bdd6c9 in Token::Match (tok=0x5555570916d0, pattern=0x555555d20dd9 "%name% (", varid=0) at lib/token.cpp:663
3  0x0000555555c62101 in getLifetimeVariable (tok=0x5555570921a0, errorPath=empty std::__debug::list) at lib/valueflow.cpp:2651
4  0x0000555555c62194 in getLifetimeVariable (tok=0x5555570921a0, errorPath=empty std::__debug::list) at lib/valueflow.cpp:2660
5  0x0000555555c62194 in getLifetimeVariable (tok=0x5555570921a0, errorPath=empty std::__debug::list) at lib/valueflow.cpp:2660
@serval2412
Copy link
Copy Markdown
Author

Argh, I badly understood, thought nullptr was better.
Anyway, I'll close this one and let you fix this correctly with associated test.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants