diff --git a/lib/clangimport.cpp b/lib/clangimport.cpp index 98c0e700d83..f9520aba4b2 100644 --- a/lib/clangimport.cpp +++ b/lib/clangimport.cpp @@ -422,15 +422,13 @@ std::string clangimport::AstNode::getSpelling() const if (nodeType == FunctionDecl || nodeType == CXXConstructorDecl || nodeType == CXXMethodDecl) { while (typeIndex >= 0 && mExtTokens[typeIndex][0] != '\'') typeIndex--; - if (typeIndex <= 0) - return ""; } if (nodeType == DeclRefExpr) { while (typeIndex > 0 && std::isalpha(mExtTokens[typeIndex][0])) typeIndex--; - if (typeIndex <= 0) - return ""; } + if (typeIndex <= 0) + return ""; const std::string &str = mExtTokens[typeIndex - 1]; if (startsWith(str,"col:")) return ""; diff --git a/test/testclangimport.cpp b/test/testclangimport.cpp index 6a39b563982..229e4c3c982 100644 --- a/test/testclangimport.cpp +++ b/test/testclangimport.cpp @@ -139,6 +139,7 @@ class TestClangImport : public TestFixture { TEST_CASE(valueType2); TEST_CASE(crash); + TEST_CASE(crash2); } std::string parse(const char clang[]) { @@ -1372,6 +1373,13 @@ class TestClangImport : public TestFixture { " `-CompoundStmt 0x5603791b5700 \n"; (void)parse(clang); // don't crash } + + void crash2() { + // getSpelling() indexed mExtTokens[typeIndex - 1] without a lower-bound + // check, so a node whose line carries no ext tokens (typeIndex <= 0) read + // out of bounds. + (void)parse("`-RecordDecl "); // don't crash + } }; REGISTER_TEST(TestClangImport)