GaloisInc / daedalus

The Daedalus data description language
BSD 3-Clause "New" or "Revised" License
65 stars 11 forks source link

Undefined behavior in the C++ backend #289

Closed ESultanik closed 1 year ago

ESultanik commented 1 year ago

When an array is constructed with no content, https://github.com/GaloisInc/daedalus/blob/daee494e910c846d13cf3af5a2d7b1af6d720bc9/rts-c/ddl/array.h#L90 the content ptr member is initialized to nullptr.

This will lead to undefined behavior due to a null pointer dereference when borrowing its data: https://github.com/GaloisInc/daedalus/blob/daee494e910c846d13cf3af5a2d7b1af6d720bc9/rts-c/ddl/array.h#L147-L149

Adding a check if ptr == nullptr before line 147 reveals that this happens many times during the course of parsing a PDF.