Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fixed fuzzing crash in CheckAssert::checkVariableAssignment() #6162

Closed
wants to merge 1 commit into from

Conversation

firewave
Copy link
Collaborator

@firewave firewave commented Mar 20, 2024

/home/user/CLionProjects/cppcheck-rider/lib/checkassert.cpp:132:53: runtime error: member call on null pointer of type 'Token'
    #0 0x63f3e941d85a in CheckAssert::checkVariableAssignment(Token const*, Scope const*) /home/user/CLionProjects/cppcheck-rider/lib/checkassert.cpp:132:53
    #1 0x63f3e941c846 in CheckAssert::assertWithSideEffects() /home/user/CLionProjects/cppcheck-rider/lib/checkassert.cpp:58:13
    #2 0x63f3e941f243 in CheckAssert::runChecks(Tokenizer const&, ErrorLogger*) /home/user/CLionProjects/cppcheck-rider/lib/checkassert.h:54:21
    #3 0x63f3e9aa04cd in CppCheck::checkNormalTokens(Tokenizer const&) /home/user/CLionProjects/cppcheck-rider/lib/cppcheck.cpp:1124:20
    #4 0x63f3e9ab94ab in CppCheck::checkFile(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&, std::istream*) /home/user/CLionProjects/cppcheck-rider/lib/cppcheck.cpp:957:17
    #5 0x63f3e9aa6a97 in CppCheck::check(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&) /home/user/CLionProjects/cppcheck-rider/lib/cppcheck.cpp:556:12
    #6 0x63f3e8ba4f2b in SingleExecutor::check() /home/user/CLionProjects/cppcheck-rider/cli/singleexecutor.cpp:53:29
    #7 0x63f3e8adf8dc in CppCheckExecutor::check_internal(Settings const&) const /home/user/CLionProjects/cppcheck-rider/cli/cppcheckexecutor.cpp:277:32
    #8 0x63f3e8ade73d in CppCheckExecutor::check_wrapper(Settings const&) /home/user/CLionProjects/cppcheck-rider/cli/cppcheckexecutor.cpp:216:12
    #9 0x63f3e8add67a in CppCheckExecutor::check(int, char const* const*) /home/user/CLionProjects/cppcheck-rider/cli/cppcheckexecutor.cpp:202:21
    #10 0x63f3ea1ee2b7 in main /home/user/CLionProjects/cppcheck-rider/cli/main.cpp:91:21
    #11 0x7a2c9501eccf  (/usr/lib/libc.so.6+0x29ccf) (BuildId: 0865c4b9ba13e0094e8b45b78dfc7a2971f536d2)
    #12 0x7a2c9501ed89 in __libc_start_main (/usr/lib/libc.so.6+0x29d89) (BuildId: 0865c4b9ba13e0094e8b45b78dfc7a2971f536d2)
    #13 0x63f3e89189f4 in _start (/home/user/CLionProjects/cppcheck-rider/cmake-build-debug-clang-asan-ubsan/bin/cppcheck+0xf6e9f4) (BuildId: 5c2986a23a9dee600c328566a7967a7eba8652c9)

… ci]

/home/user/CLionProjects/cppcheck-rider/lib/checkassert.cpp:132:53: runtime error: member call on null pointer of type 'Token'
    #0 0x63f3e941d85a in CheckAssert::checkVariableAssignment(Token const*, Scope const*) /home/user/CLionProjects/cppcheck-rider/lib/checkassert.cpp:132:53
    #1 0x63f3e941c846 in CheckAssert::assertWithSideEffects() /home/user/CLionProjects/cppcheck-rider/lib/checkassert.cpp:58:13
    danmar#2 0x63f3e941f243 in CheckAssert::runChecks(Tokenizer const&, ErrorLogger*) /home/user/CLionProjects/cppcheck-rider/lib/checkassert.h:54:21
    danmar#3 0x63f3e9aa04cd in CppCheck::checkNormalTokens(Tokenizer const&) /home/user/CLionProjects/cppcheck-rider/lib/cppcheck.cpp:1124:20
    danmar#4 0x63f3e9ab94ab in CppCheck::checkFile(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&, std::istream*) /home/user/CLionProjects/cppcheck-rider/lib/cppcheck.cpp:957:17
    danmar#5 0x63f3e9aa6a97 in CppCheck::check(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&) /home/user/CLionProjects/cppcheck-rider/lib/cppcheck.cpp:556:12
    danmar#6 0x63f3e8ba4f2b in SingleExecutor::check() /home/user/CLionProjects/cppcheck-rider/cli/singleexecutor.cpp:53:29
    danmar#7 0x63f3e8adf8dc in CppCheckExecutor::check_internal(Settings const&) const /home/user/CLionProjects/cppcheck-rider/cli/cppcheckexecutor.cpp:277:32
    danmar#8 0x63f3e8ade73d in CppCheckExecutor::check_wrapper(Settings const&) /home/user/CLionProjects/cppcheck-rider/cli/cppcheckexecutor.cpp:216:12
    danmar#9 0x63f3e8add67a in CppCheckExecutor::check(int, char const* const*) /home/user/CLionProjects/cppcheck-rider/cli/cppcheckexecutor.cpp:202:21
    danmar#10 0x63f3ea1ee2b7 in main /home/user/CLionProjects/cppcheck-rider/cli/main.cpp:91:21
    danmar#11 0x7a2c9501eccf  (/usr/lib/libc.so.6+0x29ccf) (BuildId: 0865c4b9ba13e0094e8b45b78dfc7a2971f536d2)
    danmar#12 0x7a2c9501ed89 in __libc_start_main (/usr/lib/libc.so.6+0x29d89) (BuildId: 0865c4b9ba13e0094e8b45b78dfc7a2971f536d2)
    danmar#13 0x63f3e89189f4 in _start (/home/user/CLionProjects/cppcheck-rider/cmake-build-debug-clang-asan-ubsan/bin/cppcheck+0xf6e9f4) (BuildId: 5c2986a23a9dee600c328566a7967a7eba8652c9)
@firewave
Copy link
Collaborator Author

Split from #6092.

@chrchr-github
Copy link
Collaborator

chrchr-github commented Mar 22, 2024

I get a syntaxError for the example (added in #6118).
This one is still open: {for(typedef;);}

@firewave
Copy link
Collaborator Author

I get a syntaxError for the example (added in #6118).

Confirmed. Closing this.

This one is still open: {for(typedef;);}

That is #6092.

@firewave firewave closed this Mar 24, 2024
@firewave firewave deleted the fuzz-crash-3 branch March 24, 2024 23:57
@firewave firewave restored the fuzz-crash-3 branch March 27, 2024 18:38
@firewave
Copy link
Collaborator Author

This issue still exists.

@firewave firewave reopened this Mar 27, 2024
@chrchr-github
Copy link
Collaborator

This issue still exists.

In what way?

@firewave
Copy link
Collaborator Author

This issue still exists.

In what way?

It still caused a crash in the fuzzing client. Although it was fine when I checked it manually.

I just tested it again and I know longer get the crash. Closing again.

@firewave firewave closed this Mar 28, 2024
@firewave firewave deleted the fuzz-crash-3 branch March 28, 2024 23:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants