Skip to content

Commit d26abce

Browse files
authored
[5.3] Fix NULL deref for invalid mangled input (#31878) (#31979)
* Fix NULL deref for invalid mangled input (#31878) The `Qo` operator expects to consume a type name and a list (terminated with a `y` empty list marker) from the stack. After popping the list, it doesn't check whether the stack is empty, so `$syQo` crashes (it pops down to the `y` then tries to pop again). This PR just adds the obvious check to guard against this. Resolves rdar://63128307 * Back out a bad merge
1 parent e2c5630 commit d26abce

File tree

2 files changed

+3
-0
lines changed

2 files changed

+3
-0
lines changed

lib/Demangling/Demangler.cpp

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2007,6 +2007,8 @@ NodePointer Demangler::demangleArchetype() {
20072007
if (!demangleBoundGenerics(boundGenericArgs, retroactiveConformances))
20082008
return nullptr;
20092009
auto Name = popNode();
2010+
if (!Name)
2011+
return nullptr;
20102012
auto opaque = createWithChildren(Node::Kind::OpaqueType, Name,
20112013
createNode(Node::Kind::Index, index));
20122014
auto boundGenerics = createNode(Node::Kind::TypeList);

test/Demangle/Inputs/manglings.txt

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -357,3 +357,4 @@ $s17property_wrappers10WithTuplesV9fractionsSd_S2dtvpfP --> property wrapper bac
357357
$sSo17OS_dispatch_queueC4sync7executeyyyXE_tFTOTA ---> {T:$sSo17OS_dispatch_queueC4sync7executeyyyXE_tFTO} partial apply forwarder for @nonobjc __C.OS_dispatch_queue.sync(execute: () -> ()) -> ()
358358
$sxq_Idgnr_D ---> @differentiable @callee_guaranteed (@in_guaranteed A) -> (@out B)
359359
$sxq_Ilgnr_D ---> @differentiable(linear) @callee_guaranteed (@in_guaranteed A) -> (@out B)
360+
$syQo ---> $syQo

0 commit comments

Comments
 (0)