[clang] [clang] Fix null buffer dereference in InitializeFileRemapping (PR #201289)
Kristianerik wrote: > > Thanks for the guidance. After reviewing CompilerInstanceTest.cpp and > > tracing all callers of addRemappedFile(StringRef, MemoryBuffer*) across > > clang/lib/, clang/tools/, and clang-tools-extra/, every call site passes a > > buffer constructed via getMemBuffer() or getMemBufferCopy() null is > > impossible by construction. The fuzzer was generating an invalid state that > > can't occur through any legitimate code path. I'll close this PR. > > If you had time, maybe you could take a look at #201179? This one can be > triggered directly on godbolt and I am not sure if it shares the same reason > with this one. Sorry I was a bit busy this weekend, but I took a look at #201179 and it appears to be a different issue. #201188 was a fuzzer-only state that couldn't occur in practice, while #201179 has a real reproducer on godbolt and looks like a regression introduced between clang 20 and 21, possibly related to the ModuleManager in-memory buffer changes in that timeframe. I'll investigate further and follow up on that issue directly. https://github.com/llvm/llvm-project/pull/201289 ___ cfe-commits mailing list [email protected] https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[clang] [clang] Fix null buffer dereference in InitializeFileRemapping (PR #201289)
https://github.com/Kristianerik edited https://github.com/llvm/llvm-project/pull/201289 ___ cfe-commits mailing list [email protected] https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[clang] [clang] Fix null buffer dereference in InitializeFileRemapping (PR #201289)
hongtaihu wrote: > Thanks for the guidance. After reviewing CompilerInstanceTest.cpp and tracing > all callers of addRemappedFile(StringRef, MemoryBuffer*) across clang/lib/, > clang/tools/, and clang-tools-extra/, every call site passes a buffer > constructed via getMemBuffer() or getMemBufferCopy() null is impossible by > construction. The fuzzer was generating an invalid state that can't occur > through any legitimate code path. I'll close this PR. If you had time, maybe you could take a look at https://github.com/llvm/llvm-project/issues/201179? This one can be triggered directly on godbolt and I am not sure if it shares the same reason with this one. https://github.com/llvm/llvm-project/pull/201289 ___ cfe-commits mailing list [email protected] https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[clang] [clang] Fix null buffer dereference in InitializeFileRemapping (PR #201289)
Kristianerik wrote: Could you point me to which test file would be most appropriate? And are you saying the null buffer case is impossible by construction, or just unlikely? https://github.com/llvm/llvm-project/pull/201289 ___ cfe-commits mailing list [email protected] https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[clang] [clang] Fix null buffer dereference in InitializeFileRemapping (PR #201289)
https://github.com/ojhunt requested changes to this pull request. This needs to have tests that hit the path - they're annoying, but if you have a look at other tests in the Modules test directory. That will also make it possible to better determine where this is actually going wrong - I suspect that we should (by construction) never be in a case where this can happen https://github.com/llvm/llvm-project/pull/201289 ___ cfe-commits mailing list [email protected] https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[clang] [clang] Fix null buffer dereference in InitializeFileRemapping (PR #201289)
ojhunt wrote: Just to be sure, were LLM's used at all in this PR? https://github.com/llvm/llvm-project/pull/201289 ___ cfe-commits mailing list [email protected] https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[clang] [clang] Fix null buffer dereference in InitializeFileRemapping (PR #201289)
https://github.com/Kristianerik updated https://github.com/llvm/llvm-project/pull/201289 >From 10a3cc532415078c19e809396bad1c457f97336a Mon Sep 17 00:00:00 2001 From: Kristianerik <[email protected]> Date: Wed, 3 Jun 2026 01:06:38 -0700 Subject: [PATCH 1/2] [clang] Fix null buffer dereference in InitializeFileRemappingWhen a module compilation fails partway through, a null buffer entrycan be left in PreprocessorOptions::RemappedFileBuffers. The existingcode in InitializeFileRemapping unconditionally dereferences RB.secondvia getBufferSize() and getMemBufferRef(), causing a crash.Add a null check consistent with the existing pattern in theRemappedFiles loop below, which already checks for missing filesbefore use.Fixes: https://github.com/llvm/llvm-project/issues/201188 --- clang/lib/Frontend/CompilerInstance.cpp | 7 +++ 1 file changed, 7 insertions(+) diff --git a/clang/lib/Frontend/CompilerInstance.cpp b/clang/lib/Frontend/CompilerInstance.cpp index 9e88abbece7f2..92a116af066a8 100644 --- a/clang/lib/Frontend/CompilerInstance.cpp +++ b/clang/lib/Frontend/CompilerInstance.cpp @@ -413,6 +413,13 @@ static void InitializeFileRemapping(DiagnosticsEngine &Diags, const PreprocessorOptions &InitOpts) { // Remap files in the source manager (with buffers). for (const auto &RB : InitOpts.RemappedFileBuffers) { +// Skip entries with a null buffer — this can occur when a module +// compilation fails partway through, leaving an uninitialized entry +// in RemappedFileBuffers. Treat it as a missing file and continue. +if (!RB.second) { + Diags.Report(diag::err_fe_remap_missing_to_file) << RB.first << "(null buffer)"; + continue; +} // Create the file entry for the file that we're mapping from. FileEntryRef FromFile = FileMgr.getVirtualFileRef(RB.first, RB.second->getBufferSize(), 0); >From 9ba06b789eff816a904fbf29b479adb3823b4948 Mon Sep 17 00:00:00 2001 From: Kristianerik Date: Wed, 3 Jun 2026 01:53:23 -0700 Subject: [PATCH 2/2] [clang] clang-format: wrap long line in InitializeFileRemapping --- clang/lib/Frontend/CompilerInstance.cpp | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/clang/lib/Frontend/CompilerInstance.cpp b/clang/lib/Frontend/CompilerInstance.cpp index 92a116af066a8..d9d02cb21a8f2 100644 --- a/clang/lib/Frontend/CompilerInstance.cpp +++ b/clang/lib/Frontend/CompilerInstance.cpp @@ -417,7 +417,8 @@ static void InitializeFileRemapping(DiagnosticsEngine &Diags, // compilation fails partway through, leaving an uninitialized entry // in RemappedFileBuffers. Treat it as a missing file and continue. if (!RB.second) { - Diags.Report(diag::err_fe_remap_missing_to_file) << RB.first << "(null buffer)"; + Diags.Report(diag::err_fe_remap_missing_to_file) + << RB.first << "(null buffer)"; continue; } // Create the file entry for the file that we're mapping from. ___ cfe-commits mailing list [email protected] https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[clang] [clang] Fix null buffer dereference in InitializeFileRemapping (PR #201289)
https://github.com/Kristianerik updated https://github.com/llvm/llvm-project/pull/201289 >From 10a3cc532415078c19e809396bad1c457f97336a Mon Sep 17 00:00:00 2001 From: Kristianerik <[email protected]> Date: Wed, 3 Jun 2026 01:06:38 -0700 Subject: [PATCH 1/2] [clang] Fix null buffer dereference in InitializeFileRemappingWhen a module compilation fails partway through, a null buffer entrycan be left in PreprocessorOptions::RemappedFileBuffers. The existingcode in InitializeFileRemapping unconditionally dereferences RB.secondvia getBufferSize() and getMemBufferRef(), causing a crash.Add a null check consistent with the existing pattern in theRemappedFiles loop below, which already checks for missing filesbefore use.Fixes: https://github.com/llvm/llvm-project/issues/201188 --- clang/lib/Frontend/CompilerInstance.cpp | 7 +++ 1 file changed, 7 insertions(+) diff --git a/clang/lib/Frontend/CompilerInstance.cpp b/clang/lib/Frontend/CompilerInstance.cpp index 9e88abbece7f2..92a116af066a8 100644 --- a/clang/lib/Frontend/CompilerInstance.cpp +++ b/clang/lib/Frontend/CompilerInstance.cpp @@ -413,6 +413,13 @@ static void InitializeFileRemapping(DiagnosticsEngine &Diags, const PreprocessorOptions &InitOpts) { // Remap files in the source manager (with buffers). for (const auto &RB : InitOpts.RemappedFileBuffers) { +// Skip entries with a null buffer — this can occur when a module +// compilation fails partway through, leaving an uninitialized entry +// in RemappedFileBuffers. Treat it as a missing file and continue. +if (!RB.second) { + Diags.Report(diag::err_fe_remap_missing_to_file) << RB.first << "(null buffer)"; + continue; +} // Create the file entry for the file that we're mapping from. FileEntryRef FromFile = FileMgr.getVirtualFileRef(RB.first, RB.second->getBufferSize(), 0); >From 9bf6d1978229b284e402d22f144c69365ae40a11 Mon Sep 17 00:00:00 2001 From: Kristianerik <[email protected]> Date: Wed, 3 Jun 2026 01:49:47 -0700 Subject: [PATCH 2/2] [clang] clang-format: wrap long line in InitializeFileRemapping --- clang/lib/Frontend/CompilerInstance.cpp | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/clang/lib/Frontend/CompilerInstance.cpp b/clang/lib/Frontend/CompilerInstance.cpp index 92a116af066a8..d9d02cb21a8f2 100644 --- a/clang/lib/Frontend/CompilerInstance.cpp +++ b/clang/lib/Frontend/CompilerInstance.cpp @@ -417,7 +417,8 @@ static void InitializeFileRemapping(DiagnosticsEngine &Diags, // compilation fails partway through, leaving an uninitialized entry // in RemappedFileBuffers. Treat it as a missing file and continue. if (!RB.second) { - Diags.Report(diag::err_fe_remap_missing_to_file) << RB.first << "(null buffer)"; + Diags.Report(diag::err_fe_remap_missing_to_file) + << RB.first << "(null buffer)"; continue; } // Create the file entry for the file that we're mapping from. ___ cfe-commits mailing list [email protected] https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[clang] [clang] Fix null buffer dereference in InitializeFileRemapping (PR #201289)
github-actions[bot] wrote:
:warning: C/C++ code formatter, clang-format found issues in your code.
:warning:
You can test this locally with the following command:
``bash
git-clang-format --diff origin/main HEAD --extensions cpp --
clang/lib/Frontend/CompilerInstance.cpp --diff_from_common_commit
``
:warning:
The reproduction instructions above might return results for more than one PR
in a stack if you are using a stacked PR workflow. You can limit the results by
changing `origin/main` to the base branch/commit you want to compare against.
:warning:
View the diff from clang-format here.
``diff
diff --git a/clang/lib/Frontend/CompilerInstance.cpp
b/clang/lib/Frontend/CompilerInstance.cpp
index 92a116af0..d9d02cb21 100644
--- a/clang/lib/Frontend/CompilerInstance.cpp
+++ b/clang/lib/Frontend/CompilerInstance.cpp
@@ -417,7 +417,8 @@ static void InitializeFileRemapping(DiagnosticsEngine
&Diags,
// compilation fails partway through, leaving an uninitialized entry
// in RemappedFileBuffers. Treat it as a missing file and continue.
if (!RB.second) {
- Diags.Report(diag::err_fe_remap_missing_to_file) << RB.first << "(null
buffer)";
+ Diags.Report(diag::err_fe_remap_missing_to_file)
+ << RB.first << "(null buffer)";
continue;
}
// Create the file entry for the file that we're mapping from.
``
https://github.com/llvm/llvm-project/pull/201289
___
cfe-commits mailing list
[email protected]
https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[clang] [clang] Fix null buffer dereference in InitializeFileRemapping (PR #201289)
github-actions[bot] wrote: ⚠️ We detected that you are using a GitHub private e-mail address to contribute to the repo. Please turn off [Keep my email addresses private](https://github.com/settings/emails) setting in your account. See [LLVM Developer Policy](https://llvm.org/docs/DeveloperPolicy.html#email-addresses) and [LLVM Discourse](https://discourse.llvm.org/t/hidden-emails-on-github-should-we-do-something-about-it) for more information. https://github.com/llvm/llvm-project/pull/201289 ___ cfe-commits mailing list [email protected] https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[clang] [clang] Fix null buffer dereference in InitializeFileRemapping (PR #201289)
llvmorg-github-actions[bot] wrote:
@llvm/pr-subscribers-clang
Author: Krisitan Erik Olsen (Kristianerik)
Changes
When a module compilation fails partway through, a null buffer entry
can be left in `PreprocessorOptions::RemappedFileBuffers`. The existing
code in `InitializeFileRemapping` unconditionally dereferences `RB.second`
via `getBufferSize()` and `getMemBufferRef()`, causing a crash.
Add a null check consistent with the existing pattern in the
`RemappedFiles` loop below, which already checks for missing files
before use.
The crash was discovered by a fuzzer and reported with a clear stacktrace
showing the crash at `InitializeFileRemapping` line 419.
Fixes: https://github.com/llvm/llvm-project/issues/201188
---
Full diff: https://github.com/llvm/llvm-project/pull/201289.diff
1 Files Affected:
- (modified) clang/lib/Frontend/CompilerInstance.cpp (+7)
``diff
diff --git a/clang/lib/Frontend/CompilerInstance.cpp
b/clang/lib/Frontend/CompilerInstance.cpp
index 9e88abbece7f2..92a116af066a8 100644
--- a/clang/lib/Frontend/CompilerInstance.cpp
+++ b/clang/lib/Frontend/CompilerInstance.cpp
@@ -413,6 +413,13 @@ static void InitializeFileRemapping(DiagnosticsEngine
&Diags,
const PreprocessorOptions &InitOpts) {
// Remap files in the source manager (with buffers).
for (const auto &RB : InitOpts.RemappedFileBuffers) {
+// Skip entries with a null buffer — this can occur when a module
+// compilation fails partway through, leaving an uninitialized entry
+// in RemappedFileBuffers. Treat it as a missing file and continue.
+if (!RB.second) {
+ Diags.Report(diag::err_fe_remap_missing_to_file) << RB.first << "(null
buffer)";
+ continue;
+}
// Create the file entry for the file that we're mapping from.
FileEntryRef FromFile =
FileMgr.getVirtualFileRef(RB.first, RB.second->getBufferSize(), 0);
``
https://github.com/llvm/llvm-project/pull/201289
___
cfe-commits mailing list
[email protected]
https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[clang] [clang] Fix null buffer dereference in InitializeFileRemapping (PR #201289)
https://github.com/Kristianerik created https://github.com/llvm/llvm-project/pull/201289 When a module compilation fails partway through, a null buffer entry can be left in `PreprocessorOptions::RemappedFileBuffers`. The existing code in `InitializeFileRemapping` unconditionally dereferences `RB.second` via `getBufferSize()` and `getMemBufferRef()`, causing a crash. Add a null check consistent with the existing pattern in the `RemappedFiles` loop below, which already checks for missing files before use. The crash was discovered by a fuzzer and reported with a clear stacktrace showing the crash at `InitializeFileRemapping` line 419. Fixes: https://github.com/llvm/llvm-project/issues/201188 >From 10a3cc532415078c19e809396bad1c457f97336a Mon Sep 17 00:00:00 2001 From: Kristianerik <[email protected]> Date: Wed, 3 Jun 2026 01:06:38 -0700 Subject: [PATCH] [clang] Fix null buffer dereference in InitializeFileRemappingWhen a module compilation fails partway through, a null buffer entrycan be left in PreprocessorOptions::RemappedFileBuffers. The existingcode in InitializeFileRemapping unconditionally dereferences RB.secondvia getBufferSize() and getMemBufferRef(), causing a crash.Add a null check consistent with the existing pattern in theRemappedFiles loop below, which already checks for missing filesbefore use.Fixes: https://github.com/llvm/llvm-project/issues/201188 --- clang/lib/Frontend/CompilerInstance.cpp | 7 +++ 1 file changed, 7 insertions(+) diff --git a/clang/lib/Frontend/CompilerInstance.cpp b/clang/lib/Frontend/CompilerInstance.cpp index 9e88abbece7f2..92a116af066a8 100644 --- a/clang/lib/Frontend/CompilerInstance.cpp +++ b/clang/lib/Frontend/CompilerInstance.cpp @@ -413,6 +413,13 @@ static void InitializeFileRemapping(DiagnosticsEngine &Diags, const PreprocessorOptions &InitOpts) { // Remap files in the source manager (with buffers). for (const auto &RB : InitOpts.RemappedFileBuffers) { +// Skip entries with a null buffer — this can occur when a module +// compilation fails partway through, leaving an uninitialized entry +// in RemappedFileBuffers. Treat it as a missing file and continue. +if (!RB.second) { + Diags.Report(diag::err_fe_remap_missing_to_file) << RB.first << "(null buffer)"; + continue; +} // Create the file entry for the file that we're mapping from. FileEntryRef FromFile = FileMgr.getVirtualFileRef(RB.first, RB.second->getBufferSize(), 0); ___ cfe-commits mailing list [email protected] https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
