Jens Geyer created THRIFT-6238:
----------------------------------
Summary: Compiler crashes on a doc comment that is blank or has a
NUL byte near its start
Key: THRIFT-6238
URL: https://issues.apache.org/jira/browse/THRIFT-6238
Project: Thrift
Issue Type: Bug
Components: Compiler (General)
Affects Versions: 0.24.0
Reporter: Jens Geyer
The compiler crashes on two kinds of doc comment. Both come from the
post-processing at the end of the {{doctext_begin}} rule in
{{compiler/cpp/src/thrift/thriftl.ll}}.
h3. A doc comment with nothing but blanks on its one line
{noformat}
$ printf '/** */\nstruct A {\n 1: i32 x\n}\n' > a.thrift
$ thrift --gen cpp a.thrift; echo $?
139
{noformat}
{{clean_up_doctext()}} returns {{nullptr}} when the comment holds nothing but
spaces or tabs. If that comment is the first doc comment in the file, the rule
passes the result to {{strdup()}} for the program doctext candidate without
checking it; that call came with THRIFT-3709. The same comment after an earlier
doc comment with text does not crash, and neither does a blank doc comment that
spans two lines.
h3. A NUL byte in the first two characters
{noformat}
$ printf '/**\0*/\nstruct A {\n 1: i32 x\n}\n' > b.thrift
$ thrift --gen cpp b.thrift; echo $?
thrift: .../compiler/cpp/src/thrift/thriftl.ll:160: int yylex(): Assertion
`strlen(g_doctext) >= 2' failed.
134
{noformat}
The rule copies the comment text with {{strdup()}}, which stops at the NUL, and
asserts that at least the two characters of the closing marker are left. With
{{NDEBUG}} the assert is compiled out and the next line writes before the start
of the copy; AddressSanitizer reports a heap-buffer-overflow "located 2 bytes
to the left of 1-byte region". A NUL further into the comment can end in the
first crash instead, because the text is cut at the NUL and may be left blank.
Both reproduce with 0.24.0 and with current master (Debug builds). The
compiler's parser unit tests cannot see the first one:
{{compiler/cpp/tests/thrift_test_parser_support.cc}} replaces
{{clean_up_doctext()}} with a stub that returns its argument unchanged.
_Drafted with AI assistance (Claude Opus 5); reviewed and posted by Jens Geyer._
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
