Skip to content

Commit e524007

Browse files
committed
[clang-tidy] Fix crash in bugprone-not-null-terminated-result check
The check was crashing when trying to evaluate value-dependent expressions using EvaluateAsInt() in cases where the src parameter of memcpy is value-dependent, but the length is not. Added isValueDependent() check before EvaluateAsInt() call to prevent the crash.
1 parent c4eaf56 commit e524007

File tree

2 files changed

+28
-3
lines changed

2 files changed

+28
-3
lines changed

clang-tools-extra/clang-tidy/bugprone/NotNullTerminatedResultCheck.cpp

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -64,15 +64,17 @@ static unsigned getLength(const Expr *E,
6464
if (!E)
6565
return 0;
6666

67-
Expr::EvalResult Length;
6867
E = E->IgnoreImpCasts();
6968

7069
if (const auto *LengthDRE = dyn_cast<DeclRefExpr>(E))
7170
if (const auto *LengthVD = dyn_cast<VarDecl>(LengthDRE->getDecl()))
7271
if (!isa<ParmVarDecl>(LengthVD))
7372
if (const Expr *LengthInit = LengthVD->getInit())
74-
if (LengthInit->EvaluateAsInt(Length, *Result.Context))
75-
return Length.Val.getInt().getZExtValue();
73+
if (!LengthInit->isValueDependent()) {
74+
Expr::EvalResult Length;
75+
if (LengthInit->EvaluateAsInt(Length, *Result.Context))
76+
return Length.Val.getInt().getZExtValue();
77+
}
7678

7779
if (const auto *LengthIL = dyn_cast<IntegerLiteral>(E))
7880
return LengthIL->getValue().getZExtValue();
Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
// RUN: %check_clang_tidy %s bugprone-not-null-terminated-result %t -- \
2+
// RUN: -- -std=c++17 -I %S/Inputs/not-null-terminated-result
3+
4+
// This test case reproduces the crash when the check tries to evaluate
5+
// a value-dependent expression using EvaluateAsInt() in
6+
// bugprone-not-null-terminated-result, where the src parameter of memcpy is
7+
// value-dependent, but the length is not.
8+
9+
// expected-no-diagnostics
10+
11+
#include "not-null-terminated-result-cxx.h"
12+
13+
template<size_t N>
14+
class ValueDependentClass {
15+
public:
16+
void copyData(char* Dst) {
17+
const char* Src = reinterpret_cast<const char*>(this);
18+
// The length parameter is arbitrary, but the crash is not reproduced if it is N.
19+
memcpy(Dst, Src, 32);
20+
}
21+
};
22+
23+
template class ValueDependentClass<42>; // The template parameter value is arbitrary.

0 commit comments

Comments
 (0)