diff mbox series

fix null pointer deref on return expression with invalid type

Message ID 20201016222831.23305-1-luc.vanoostenryck@gmail.com (mailing list archive)
State Mainlined, archived
Headers show
Series fix null pointer deref on return expression with invalid type | expand

Commit Message

Luc Van Oostenryck Oct. 16, 2020, 10:28 p.m. UTC 
If the evaluation of the return expression failed a following test
can dereference the pointer holding the expression's type ...
which is null. Bad.

Fix this by adding the missing null pointer test.

Fixes: 3bc32d46494c404df7905fceaca9156830ff97f1
Signed-off-by: Luc Van Oostenryck <luc.vanoostenryck@gmail.com>
---
 evaluate.c                         | 2 +-
 validation/crash-undef-in-parens.c | 9 +++++++++
 2 files changed, 10 insertions(+), 1 deletion(-)
 create mode 100644 validation/crash-undef-in-parens.c
diff mbox series

Patch

diff --git a/evaluate.c b/evaluate.c
index 3ff76fa85e14..16e11fe1b5a2 100644
--- a/evaluate.c
+++ b/evaluate.c
@@ -3611,7 +3611,7 @@  static struct symbol *evaluate_return_expression(struct statement *stmt)
 	fntype = current_fn->ctype.base_type;
 	rettype = fntype->ctype.base_type;
 	if (!rettype || rettype == &void_ctype) {
-		if (expr && !is_void_type(expr->ctype))
+		if (expr && expr->ctype && !is_void_type(expr->ctype))
 			expression_error(expr, "return expression in %s function", rettype?"void":"typeless");
 		if (expr && Wreturn_void)
 			warning(stmt->pos, "returning void-valued expression");
diff --git a/validation/crash-undef-in-parens.c b/validation/crash-undef-in-parens.c
new file mode 100644
index 000000000000..5f05f88a6776
--- /dev/null
+++ b/validation/crash-undef-in-parens.c
@@ -0,0 +1,9 @@ 
+void foo(void) { return (UNDEF_STUFF_IN_PARENS); }
+
+/*
+ * check-name: crash-undef-in-parens
+ *
+ * check-error-start
+crash-undef-in-parens.c:1:26: error: undefined identifier 'UNDEF_STUFF_IN_PARENS'
+ * check-error-end
+ */