llvm / llvm/llvm-project

Clang Frontend Crash - Compiling Malformed Input Containing Recursive Include and Unbalanced Parentheses

Open
#181,735 3 comments 0 reactions 0 assignees View on GitHub
clang:frontend crash-on-invalid generated by fuzzer
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

Clang crashes when compiling the following malformed C input. This issue was discovered via fuzzing with AFL++ and minimized by hand. The crash is reproducible.

Tested on Clang 21.1.8 on Ubuntu 25 and Clang 21.1.0 on CompilerExplorer.

### Code:
```c
func() {

#include __FILE__
(((((((
```
### Command:
```
clang ./crashing_file.c
```
### Expected Output:
Syntax Error and safe termination

### Actual Behavior
Clang crashes with segmentation fault during parsing.

### Portion of the Stack Trace:
```
"Stacktrace": [
"#0 0x000055555ea2e3c4 in clang::Lexer::LexTokenInternal (this=0x55556218b810, Result=..., TokAtPhysicalStartOfLine=) at clang/lib/Lex/Lexer.cpp:3740",
"#1 0x000055555eb199ba in clang::Preprocessor::Lex (this=0x1, Result=...) at clang/lib/Lex/Preprocessor.cpp:896",
"#2 0x000055555c3d82aa in clang::Parser::ConsumeParen (this=) at clang/include/clang/Parse/Parser.h:642",
"#3 clang::BalancedDelimiterTracker::consumeOpen (this=0x7fffff7ff128) at clang/include/clang/Parse/RAIIObjectsForParser.h:471",
"#4 clang::Parser::ParseParenExpression (this=this@entry=0x555562159280, ExprType=@0x7fffff7ffec0: clang::ParenParseOption::CastExpr, StopIfCastExpr=false, ParenBehavior=ParenBehavior@entry=clang::ParenExprKind::Unknown, CorrectionBehavior=clang::TypoCorrectionTypeBehavior::AllowBoth, CastTy=..., RParenLoc=...) at clang/lib/Parse/ParseExpr.cpp:2618",
"#5 0x000055555c3d58ed in clang::Parser::ParseCastExpression (this=0x555562159280, ParseKind=ParseKind@entry=clang::CastParseKind::AnyCastExpr, isAddressOfOperand=, NotCastExpr=@0x7fffff800d37: false, CorrectionBehavior=(clang::TypoCorrectionTypeBehavior::AllowTypes | unknown: 0xfc), isVectorLiteral=false, NotPrimaryExpression=) at clang/lib/Parse/ParseExpr.cpp:763",
"#6 0x000055555c3cad9d in clang::Parser::ParseCastExpression (this=0x1, ParseKind=clang::CastParseKind::AnyCastExpr, isAddressOfOperand=false, CorrectionBehavior=(clang::TypoCorrectionTypeBehavior::AllowTypes | unknown: 0xfc), isVectorLiteral=false, NotPrimaryExpression=0x0) at clang/lib/Parse/ParseExpr.cpp:567",
"#7 clang::Parser::ParseAssignmentExpression (this=0x1, this@entry=0x555562159280, CorrectionBehavior=(clang::TypoCorrectionTypeBehavior::AllowTypes | unknown: 0xfc), CorrectionBehavior@entry=clang::TypoCorrectionTypeBehavior::AllowBoth) at clang/lib/Parse/ParseExpr.cpp:90",
```

### Environment:
clang version 21.1.8
OS: Ubuntu 25.04
Architecture: x86_64
RAM: 8GB

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.