Potential null pointer dereference in Sema::PerformContextualImplicitConversion
- Dominant language
- LLVM
- Stars
- 40.5k
- Forks
- 18.7k
- PR merge metrics
- PR metrics pending
Description
`From` is being unconditionally dereferenced at: https://github.com/llvm/llvm-project/blob/66e8cc5ec83d7ec5e506c53b11c1d22887c0c418/clang/lib/Sema/SemaOverload.cpp#L7062
However, it can explicitly be null from: https://github.com/llvm/llvm-project/blob/66e8cc5ec83d7ec5e506c53b11c1d22887c0c418/clang/lib/Sema/SemaOverload.cpp#L7050
I think there are other mechanisms which prevent this from happening; I cannot find any evidence of crashes from this in practice or induce a crash myself. However, this was reported via a static analysis tool as a potential issue and I think more investigation is warranted. In particular, it looks like if lvalue conversion fails then this code should assert because `T` is invalid: https://github.com/llvm/llvm-project/blob/66e8cc5ec83d7ec5e506c53b11c1d22887c0c418/clang/lib/Sema/SemaOverload.cpp#L7059 so I don't think we can ever get to the null pointer dereference without hitting an earlier bug. But it's unclear how to induce the failure in default lvalue conversion in a way that doesn't prevent getting to `PerformContextualImplicitConversion()` in the first place.
Contributor guide
Research direction
Start in clang/lib/Sema/SemaOverload.cpp at PerformContextualImplicitConversion and inspect the paths around the cited lvalue conversion and unconditional From dereference. Determine whether a null From can reach that dereference, reproduce the path if possible, and leave the code with a verified invariant or a regression test covering the finding.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- compilers
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 45/100