Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

malformed clang::SourceRange results in kaskara-statement-finder abort #62

Open
pdreiter opened this issue Mar 27, 2023 · 2 comments
Open
Assignees

Comments

@pdreiter
Copy link
Collaborator

From the following log output, we can see that the getEndLoc() component of the DEBUG statement below refers to line 0, column 0, which results in an abort, due to improper length calculation from file offset.

DEBUG: obtained statement location: /workspace/source/catalog.c@2157:4::0:0
terminate called after throwing an instance of 'std::length_error'
  what():  basic_string::_M_create
/opt/kaskara/scripts/kaskara-statement-finder: line 5:    58 Aborted                 (core dumped) /opt/kaskara/bin/kaskara-statement-finder "$@"

With the location information above, we can see that the length calculation on ./lib/kaskara/clang/backend/src/util.cpp @ 61 would be negative.

 56 std::string read_source(clang::SourceManager const &SM, 
 57                         clang::SourceRange const &range)
 58 {
 59   clang::SourceLocation loc_start = range.getBegin();
 60   clang::SourceLocation loc_end = range.getEnd();
 61   int length = SM.getFileOffset(loc_end) - SM.getFileOffset(loc_start);
 62   const char *buff = SM.getCharacterData(loc_start);
 63   return llvm::StringRef(buff, length + 1).str();
 64 }
@pdreiter
Copy link
Collaborator Author

Looking at this specific source file: catalog.c @ line 2157:

2152 static const xmlChar *
2153 xmlParseSGMLCatalogComment(const xmlChar *cur) {
2154     if ((cur[0] != '-') || (cur[1] != '-'))
2155         return(cur);
2156     SKIP(2);
2157     while ((cur[0] != 0) && ((cur[0] != '-') || ((cur[1] != '-'))))
2158         NEXT;
2159     if (cur[0] == 0) {
2160         return(NULL);
2161     }
2162     return(cur + 2);
2163 }
2164 

@pdreiter
Copy link
Collaborator Author

@ChrisTimperley - looks like Andrey hit this same issue this morning

# for free to join this conversation on GitHub. Already have an account? # to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants