]> git.draconx.ca Git - cdecl99.git/commit
Fix use-after-free during parser error recovery.
authorNick Bowler <nbowler@draconx.ca>
Sat, 4 Jul 2020 17:28:53 +0000 (13:28 -0400)
committerNick Bowler <nbowler@draconx.ca>
Sat, 4 Jul 2020 17:38:23 +0000 (13:38 -0400)
commit76252467a9696b3d649083e7a8325fd1e14e3d87
tree55fa3ce58340c7eb3c776176cb6bfbedb51242a0
parent1e7603ac5a3cca436d75ab0ee0778ec18919cbd8
Fix use-after-free during parser error recovery.

When parsing a declaration containing more than one full declarator,
each such declarator references the same list of declaration specifiers.

While processing the declarators the specifier list is normalized and
each declarator needs to be updated to the new list.

However, if a syntax error is detected we break out of the processing
loop and end up with only some of these updates occurring.  When the
partially-updated declaration list is subsequently freed, this can
in some cases lead to a use after free when the stale pointers are
encountered.

Fix this by updating all the specifier references before doing any
further processing to avoid dealing with partially-updated lists.
src/parse-decl.c
tests/decl-bad.at