llvm / llvm/llvm-project

Potential null pointer dereference in Sema::PerformContextualImplicitConversion

Open
#210,056 1 comment 1 reaction 0 assignees View on GitHub
clang:frontend code-quality
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

`From` is being unconditionally dereferenced at: https://github.com/llvm/llvm-project/blob/66e8cc5ec83d7ec5e506c53b11c1d22887c0c418/clang/lib/Sema/SemaOverload.cpp#L7062

However, it can explicitly be null from: https://github.com/llvm/llvm-project/blob/66e8cc5ec83d7ec5e506c53b11c1d22887c0c418/clang/lib/Sema/SemaOverload.cpp#L7050

I think there are other mechanisms which prevent this from happening; I cannot find any evidence of crashes from this in practice or induce a crash myself. However, this was reported via a static analysis tool as a potential issue and I think more investigation is warranted. In particular, it looks like if lvalue conversion fails then this code should assert because `T` is invalid: https://github.com/llvm/llvm-project/blob/66e8cc5ec83d7ec5e506c53b11c1d22887c0c418/clang/lib/Sema/SemaOverload.cpp#L7059 so I don't think we can ever get to the null pointer dereference without hitting an earlier bug. But it's unclear how to induce the failure in default lvalue conversion in a way that doesn't prevent getting to `PerformContextualImplicitConversion()` in the first place.

Contributor guide

Open the contributing guide

Research direction

Start in clang/lib/Sema/SemaOverload.cpp at PerformContextualImplicitConversion and inspect the paths around the cited lvalue conversion and unconditional From dereference. Determine whether a null From can reach that dereference, reproduce the path if possible, and leave the code with a verified invariant or a regression test covering the finding.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
compilers
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Needs clarification
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.