llvm / llvm/llvm-project

[Clang] Heap-buffer-overflow in clang::QualType::print

Open
#189,558 3 comments 0 reactions 0 assignees View on GitHub
clang:frontend compiler-rt:asan crash-on-invalid
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

## Description
A heap-buffer-overflow was detected in clang (version 22.0.0git) during the instantiation of a template containing a static_assert that performs an explicit destructor call on a potentially incomplete type.

## Program:
```c
#include
#include
#include

template
struct Incomplete {};

template<>
struct Incomplete {
~Incomplete() {}
};

template
struct S {
// Triggering heap-buffer-overflow via explicit destructor call on incomplete type within static_assert
static_assert(((S>*)0)->~S>(), "Static assertion failed");
};

int main(int argc, char **argv) {
S s_instance;
}
```

## The main stack trace
```
SUMMARY: AddressSanitizer: heap-buffer-overflow (/workspace/install/llvm/build_21.1.4/bin/clang-22+0x221e47b5) (BuildId: 50dec8884838af90171108e9955bb32c8275f748) in clang::QualType::print(clang::Type const*, clang::Qualifiers, llvm::raw_ostream&, clang::PrintingPolicy const&, llvm::Twine const&, unsigned int)
Shadow bytes around the buggy address:
0x713e8eabc200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x713e8eabc280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x713e8eabc300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x713e8eabc380: fa fa fa fa fa fa fa fa f1 f1 f1 f1 00 00 f2 f2
0x713e8eabc400: 00 00 f2 f2 00 00 f2 f2 00 00 f2 f2 00 00 f2 f2
=>0x713e8eabc480: 00 00 f2 f2 00 00 00 f2 f2 f2 f2 f2[fa]fa fa fa
0x713e8eabc500: fa fa fa fa fa fa fa fa fa fa fa fa 00 00 00 f3
0x713e8eabc580: f3 f3 f3 f3 f3 f3 f3 f3 fa fa fa fa fa fa fa fa
0x713e8eabc600: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x713e8eabc680: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x713e8eabc700: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
```
## The clang version:
```
clang version 22.0.0git
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /workspace/install/llvm/build_21.1.4/bin
Build config: +assertions
Found candidate GCC installation: /usr/lib/gcc/x86_64-linux-gnu/13
Selected GCC installation: /usr/lib/gcc/x86_64-linux-gnu/13
Candidate multilib: .;@m64
Selected multilib: .;@m64
```
## The report link:
[heap-buffer-overflow.zip](https://github.com/user-attachments/files/26371520/heap-buffer-overflow.zip)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.