https://github.com/ilovepi updated https://github.com/llvm/llvm-project/pull/166995
>From dbedc1cb2ccd8e6b94b4d8f575722551af00705a Mon Sep 17 00:00:00 2001 From: Paul Kirth <[email protected]> Date: Fri, 7 Nov 2025 10:51:39 -0800 Subject: [PATCH 1/3] [clang] Fix possible nullptr deref in BuildCXXNestedNameSpecifier There is a possible nullptr deref in BuildCXXNestedNameSpecifier when calling ExtendNestedNameSpecifier or using isa<>. This initially showed up as a crash in clangd, that didn't manifest in when compiling w/ clang. The reduced test case added in this patch, however does expose the issue in clang. Testing locally shows that both this test case and the original clangd issue are fixed by checking the validity of the pointer before trying to dispatch. Since all code paths require the pointer to be valid (usually by virtue of a dyn_cast or isa<> check), there should be no functional difference. Fixes #166843 --- clang/lib/Sema/SemaCXXScopeSpec.cpp | 39 +++++++++++++++-------------- 1 file changed, 20 insertions(+), 19 deletions(-) diff --git a/clang/lib/Sema/SemaCXXScopeSpec.cpp b/clang/lib/Sema/SemaCXXScopeSpec.cpp index c52fc5bf815af..29e697d9eb029 100644 --- a/clang/lib/Sema/SemaCXXScopeSpec.cpp +++ b/clang/lib/Sema/SemaCXXScopeSpec.cpp @@ -779,25 +779,26 @@ bool Sema::BuildCXXNestedNameSpecifier(Scope *S, NestedNameSpecInfo &IdInfo, } if (!Found.empty()) { - const auto *ND = Found.getAsSingle<NamedDecl>(); - if (::ExtendNestedNameSpecifier(*this, SS, ND, IdInfo.IdentifierLoc, - IdInfo.CCLoc)) { - const Type *T = SS.getScopeRep().getAsType(); - Diag(IdInfo.IdentifierLoc, diag::err_expected_class_or_namespace) - << QualType(T, 0) << getLangOpts().CPlusPlus; - // Recover with this type if it would be a valid nested name specifier. - return !T->getAsCanonical<TagType>(); - } - if (isa<TemplateDecl>(ND)) { - ParsedType SuggestedType; - DiagnoseUnknownTypeName(IdInfo.Identifier, IdInfo.IdentifierLoc, S, &SS, - SuggestedType); - } else { - Diag(IdInfo.IdentifierLoc, diag::err_expected_class_or_namespace) - << IdInfo.Identifier << getLangOpts().CPlusPlus; - if (NamedDecl *ND = Found.getAsSingle<NamedDecl>()) - Diag(ND->getLocation(), diag::note_entity_declared_at) - << IdInfo.Identifier; + if (const auto *ND = Found.getAsSingle<NamedDecl>()) { + if (::ExtendNestedNameSpecifier(*this, SS, ND, IdInfo.IdentifierLoc, + IdInfo.CCLoc)) { + const Type *T = SS.getScopeRep().getAsType(); + Diag(IdInfo.IdentifierLoc, diag::err_expected_class_or_namespace) + << QualType(T, 0) << getLangOpts().CPlusPlus; + // Recover with this type if it would be a valid nested name specifier. + return !T->getAsCanonical<TagType>(); + } + if (isa<TemplateDecl>(ND)) { + ParsedType SuggestedType; + DiagnoseUnknownTypeName(IdInfo.Identifier, IdInfo.IdentifierLoc, S, &SS, + SuggestedType); + } else { + Diag(IdInfo.IdentifierLoc, diag::err_expected_class_or_namespace) + << IdInfo.Identifier << getLangOpts().CPlusPlus; + if (NamedDecl *ND = Found.getAsSingle<NamedDecl>()) + Diag(ND->getLocation(), diag::note_entity_declared_at) + << IdInfo.Identifier; + } } } else if (SS.isSet()) Diag(IdInfo.IdentifierLoc, diag::err_no_member) << IdInfo.Identifier >From be21d3d0f40b7d0e6e6938785547383da2ced784 Mon Sep 17 00:00:00 2001 From: Paul Kirth <[email protected]> Date: Fri, 7 Nov 2025 11:19:51 -0800 Subject: [PATCH 2/3] Prefer early return to avoid excessive diff --- clang/lib/Sema/SemaCXXScopeSpec.cpp | 41 +++++++++++++++-------------- 1 file changed, 21 insertions(+), 20 deletions(-) diff --git a/clang/lib/Sema/SemaCXXScopeSpec.cpp b/clang/lib/Sema/SemaCXXScopeSpec.cpp index 29e697d9eb029..81ff2ef69ef37 100644 --- a/clang/lib/Sema/SemaCXXScopeSpec.cpp +++ b/clang/lib/Sema/SemaCXXScopeSpec.cpp @@ -779,26 +779,27 @@ bool Sema::BuildCXXNestedNameSpecifier(Scope *S, NestedNameSpecInfo &IdInfo, } if (!Found.empty()) { - if (const auto *ND = Found.getAsSingle<NamedDecl>()) { - if (::ExtendNestedNameSpecifier(*this, SS, ND, IdInfo.IdentifierLoc, - IdInfo.CCLoc)) { - const Type *T = SS.getScopeRep().getAsType(); - Diag(IdInfo.IdentifierLoc, diag::err_expected_class_or_namespace) - << QualType(T, 0) << getLangOpts().CPlusPlus; - // Recover with this type if it would be a valid nested name specifier. - return !T->getAsCanonical<TagType>(); - } - if (isa<TemplateDecl>(ND)) { - ParsedType SuggestedType; - DiagnoseUnknownTypeName(IdInfo.Identifier, IdInfo.IdentifierLoc, S, &SS, - SuggestedType); - } else { - Diag(IdInfo.IdentifierLoc, diag::err_expected_class_or_namespace) - << IdInfo.Identifier << getLangOpts().CPlusPlus; - if (NamedDecl *ND = Found.getAsSingle<NamedDecl>()) - Diag(ND->getLocation(), diag::note_entity_declared_at) - << IdInfo.Identifier; - } + const auto *ND = Found.getAsSingle<NamedDecl>(); + if(!ND) + return true; + if (::ExtendNestedNameSpecifier(*this, SS, ND, IdInfo.IdentifierLoc, + IdInfo.CCLoc)) { + const Type *T = SS.getScopeRep().getAsType(); + Diag(IdInfo.IdentifierLoc, diag::err_expected_class_or_namespace) + << QualType(T, 0) << getLangOpts().CPlusPlus; + // Recover with this type if it would be a valid nested name specifier. + return !T->getAsCanonical<TagType>(); + } + if (isa<TemplateDecl>(ND)) { + ParsedType SuggestedType; + DiagnoseUnknownTypeName(IdInfo.Identifier, IdInfo.IdentifierLoc, S, &SS, + SuggestedType); + } else { + Diag(IdInfo.IdentifierLoc, diag::err_expected_class_or_namespace) + << IdInfo.Identifier << getLangOpts().CPlusPlus; + if (NamedDecl *ND = Found.getAsSingle<NamedDecl>()) + Diag(ND->getLocation(), diag::note_entity_declared_at) + << IdInfo.Identifier; } } else if (SS.isSet()) Diag(IdInfo.IdentifierLoc, diag::err_no_member) << IdInfo.Identifier >From 5796fc8f877878f69babf9c163242895761a13f1 Mon Sep 17 00:00:00 2001 From: Paul Kirth <[email protected]> Date: Fri, 7 Nov 2025 11:22:00 -0800 Subject: [PATCH 3/3] Add missing test case that wasn't uploaded --- clang/test/Sema/PR166843.cpp | 7 +++++++ 1 file changed, 7 insertions(+) create mode 100644 clang/test/Sema/PR166843.cpp diff --git a/clang/test/Sema/PR166843.cpp b/clang/test/Sema/PR166843.cpp new file mode 100644 index 0000000000000..9160407677ab0 --- /dev/null +++ b/clang/test/Sema/PR166843.cpp @@ -0,0 +1,7 @@ +// RUN: %clang_cc1 -fsyntax-only %s -verify +namespace a { +template <class b> +void c() { + ((::c::)); // expected-error {{expected unqualified-id}} +} +} _______________________________________________ cfe-commits mailing list [email protected] https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
