Skip to content

Commit 55d6061

Browse files
authored
Fix NULL deref for invalid mangled input (swiftlang#31878)
The `Qo` operator expects to consume a type name and a list (terminated with a `y` empty list marker) from the stack. After popping the list, it doesn't check whether the stack is empty, so `$syQo` crashes (it pops down to the `y` then tries to pop again). This PR just adds the obvious check to guard against this. Resolves rdar://63128307
1 parent 028c59b commit 55d6061

File tree

2 files changed

+3
-0
lines changed

2 files changed

+3
-0
lines changed

lib/Demangling/Demangler.cpp

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2019,6 +2019,8 @@ NodePointer Demangler::demangleArchetype() {
20192019
if (!demangleBoundGenerics(boundGenericArgs, retroactiveConformances))
20202020
return nullptr;
20212021
auto Name = popNode();
2022+
if (!Name)
2023+
return nullptr;
20222024
auto opaque = createWithChildren(Node::Kind::OpaqueType, Name,
20232025
createNode(Node::Kind::Index, index));
20242026
auto boundGenerics = createNode(Node::Kind::TypeList);

test/Demangle/Inputs/manglings.txt

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -358,3 +358,4 @@ $sSo17OS_dispatch_queueC4sync7executeyyyXE_tFTOTA ---> {T:$sSo17OS_dispatch_queu
358358
$sxq_Idgnr_D ---> @differentiable @callee_guaranteed (@in_guaranteed A) -> (@out B)
359359
$sxq_Ilgnr_D ---> @differentiable(linear) @callee_guaranteed (@in_guaranteed A) -> (@out B)
360360
$sS3fIedgyywd_D ---> @escaping @differentiable @callee_guaranteed (@unowned Swift.Float, @unowned @noDerivative Swift.Float) -> (@unowned Swift.Float)
361+
$syQo ---> $syQo

0 commit comments

Comments
 (0)