Skip to content
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.

Commit fb4f6fb

Browse files
dbaileychessdbaileychess
committedMay 3, 2023
fix possible null dereference for nested_root accessor
1 parent 19d8942 commit fb4f6fb

File tree

2 files changed

+33
-23
lines changed

2 files changed

+33
-23
lines changed
 

‎src/idl_gen_cpp.cpp

Lines changed: 24 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -987,7 +987,7 @@ class CppGenerator : public BaseGenerator {
987987

988988
std::string UnionVectorVerifySignature(const EnumDef &enum_def) {
989989
const std::string name = Name(enum_def);
990-
const std::string & type = opts_.scoped_enums ? name : "uint8_t";
990+
const std::string &type = opts_.scoped_enums ? name : "uint8_t";
991991
return "bool Verify" + name + "Vector" +
992992
"(::flatbuffers::Verifier &verifier, " +
993993
"const ::flatbuffers::Vector<::flatbuffers::Offset<void>> "
@@ -1807,7 +1807,7 @@ class CppGenerator : public BaseGenerator {
18071807
field.value.type.element != BASE_TYPE_UTYPE)) {
18081808
auto type = GenTypeNative(field.value.type, false, field);
18091809
auto cpp_type = field.attributes.Lookup("cpp_type");
1810-
const std::string & full_type =
1810+
const std::string &full_type =
18111811
(cpp_type
18121812
? (IsVector(field.value.type)
18131813
? "std::vector<" +
@@ -1954,9 +1954,10 @@ class CppGenerator : public BaseGenerator {
19541954
if (!initializer_list.empty()) { initializer_list += ",\n "; }
19551955
const auto cpp_type = field->attributes.Lookup("cpp_type");
19561956
const auto cpp_ptr_type = field->attributes.Lookup("cpp_ptr_type");
1957-
const std::string & type_name = (cpp_type) ? cpp_type->constant
1958-
: GenTypeNative(type, /*invector*/ false,
1959-
*field, /*forcopy*/ true);
1957+
const std::string &type_name =
1958+
(cpp_type) ? cpp_type->constant
1959+
: GenTypeNative(type, /*invector*/ false, *field,
1960+
/*forcopy*/ true);
19601961
const bool is_ptr = !(IsStruct(type) && field->native_inline) ||
19611962
(cpp_type && cpp_ptr_type->constant != "naked");
19621963
CodeWriter cw;
@@ -1976,10 +1977,10 @@ class CppGenerator : public BaseGenerator {
19761977
if (vec_type.base_type == BASE_TYPE_UTYPE) continue;
19771978
const auto cpp_type = field->attributes.Lookup("cpp_type");
19781979
const auto cpp_ptr_type = field->attributes.Lookup("cpp_ptr_type");
1979-
const std::string & type_name = (cpp_type)
1980-
? cpp_type->constant
1981-
: GenTypeNative(vec_type, /*invector*/ true,
1982-
*field, /*forcopy*/ true);
1980+
const std::string &type_name =
1981+
(cpp_type) ? cpp_type->constant
1982+
: GenTypeNative(vec_type, /*invector*/ true, *field,
1983+
/*forcopy*/ true);
19831984
const bool is_ptr = IsVectorOfPointers(*field) ||
19841985
(cpp_type && cpp_ptr_type->constant != "naked");
19851986
CodeWriter cw(" ");
@@ -2733,9 +2734,10 @@ class CppGenerator : public BaseGenerator {
27332734
if (!nfn.empty()) {
27342735
code_.SetValue("CPP_NAME", nfn);
27352736
code_ += " const {{CPP_NAME}} *{{FIELD_NAME}}_nested_root() const {";
2737+
code_ += " const auto _f = {{FIELD_NAME}}();";
27362738
code_ +=
2737-
" return "
2738-
"::flatbuffers::GetRoot<{{CPP_NAME}}>({{FIELD_NAME}}()->Data());";
2739+
" return _f ? ::flatbuffers::GetRoot<{{CPP_NAME}}>(_f->Data())";
2740+
code_ += " : nullptr;";
27392741
code_ += " }";
27402742
}
27412743

@@ -2745,9 +2747,9 @@ class CppGenerator : public BaseGenerator {
27452747
" const {";
27462748
// Both Data() and size() are const-methods, therefore call order
27472749
// doesn't matter.
2748-
code_ +=
2749-
" return flexbuffers::GetRoot({{FIELD_NAME}}()->Data(), "
2750-
"{{FIELD_NAME}}()->size());";
2750+
code_ += " const auto _f = {{FIELD_NAME}}();";
2751+
code_ += " return _f ? flexbuffers::GetRoot(_f->Data(), _f->size())";
2752+
code_ += " : flexbuffers::Reference();";
27512753
code_ += " }";
27522754
}
27532755

@@ -2835,8 +2837,9 @@ class CppGenerator : public BaseGenerator {
28352837
// Generate code to do force_align for the vector.
28362838
if (align > 1) {
28372839
const auto vtype = field.value.type.VectorType();
2838-
const std::string & type = IsStruct(vtype) ? WrapInNameSpace(*vtype.struct_def)
2839-
: GenTypeWire(vtype, "", false);
2840+
const std::string &type = IsStruct(vtype)
2841+
? WrapInNameSpace(*vtype.struct_def)
2842+
: GenTypeWire(vtype, "", false);
28402843
return "_fbb.ForceVectorAlignment(" + field_size + ", sizeof(" + type +
28412844
"), " + std::to_string(static_cast<long long>(align)) + ");";
28422845
}
@@ -3357,8 +3360,9 @@ class CppGenerator : public BaseGenerator {
33573360
}
33583361
case BASE_TYPE_UTYPE: {
33593362
value = StripUnionType(value);
3360-
const std::string & type = opts_.scoped_enums ? Name(*field.value.type.enum_def)
3361-
: "uint8_t";
3363+
const std::string &type = opts_.scoped_enums
3364+
? Name(*field.value.type.enum_def)
3365+
: "uint8_t";
33623366
auto enum_value = "__va->_" + value + "[i].type";
33633367
if (!opts_.scoped_enums)
33643368
enum_value = "static_cast<uint8_t>(" + enum_value + ")";
@@ -3424,7 +3428,7 @@ class CppGenerator : public BaseGenerator {
34243428
}
34253429
} else {
34263430
// _o->field ? CreateT(_fbb, _o->field.get(), _rehasher);
3427-
const std::string & type = field.value.type.struct_def->name;
3431+
const std::string &type = field.value.type.struct_def->name;
34283432
code += value + " ? Create" + type;
34293433
code += "(_fbb, " + value;
34303434
if (!field.native_inline) code += GenPtrGet(field);
@@ -3810,7 +3814,7 @@ class CppGenerator : public BaseGenerator {
38103814
const auto field_type = GenTypeGet(type, " ", is_array ? "" : "const ",
38113815
is_array ? "" : " &", true);
38123816
auto member = Name(*field) + "_";
3813-
const std::string & value =
3817+
const std::string &value =
38143818
is_scalar ? "::flatbuffers::EndianScalar(" + member + ")" : member;
38153819

38163820
code_.SetValue("FIELD_NAME", Name(*field));

‎tests/monster_test_generated.h

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1487,7 +1487,9 @@ struct Monster FLATBUFFERS_FINAL_CLASS : private ::flatbuffers::Table {
14871487
return GetPointer<::flatbuffers::Vector<uint8_t> *>(VT_TESTNESTEDFLATBUFFER);
14881488
}
14891489
const MyGame::Example::Monster *testnestedflatbuffer_nested_root() const {
1490-
return ::flatbuffers::GetRoot<MyGame::Example::Monster>(testnestedflatbuffer()->Data());
1490+
const auto _f = testnestedflatbuffer();
1491+
return _f ? ::flatbuffers::GetRoot<MyGame::Example::Monster>(_f->Data())
1492+
: nullptr;
14911493
}
14921494
const MyGame::Example::Stat *testempty() const {
14931495
return GetPointer<const MyGame::Example::Stat *>(VT_TESTEMPTY);
@@ -1592,7 +1594,9 @@ struct Monster FLATBUFFERS_FINAL_CLASS : private ::flatbuffers::Table {
15921594
return GetPointer<::flatbuffers::Vector<uint8_t> *>(VT_FLEX);
15931595
}
15941596
flexbuffers::Reference flex_flexbuffer_root() const {
1595-
return flexbuffers::GetRoot(flex()->Data(), flex()->size());
1597+
const auto _f = flex();
1598+
return _f ? flexbuffers::GetRoot(_f->Data(), _f->size())
1599+
: flexbuffers::Reference();
15961600
}
15971601
const ::flatbuffers::Vector<const MyGame::Example::Test *> *test5() const {
15981602
return GetPointer<const ::flatbuffers::Vector<const MyGame::Example::Test *> *>(VT_TEST5);
@@ -1722,7 +1726,9 @@ struct Monster FLATBUFFERS_FINAL_CLASS : private ::flatbuffers::Table {
17221726
return GetPointer<::flatbuffers::Vector<uint8_t> *>(VT_TESTREQUIREDNESTEDFLATBUFFER);
17231727
}
17241728
const MyGame::Example::Monster *testrequirednestedflatbuffer_nested_root() const {
1725-
return ::flatbuffers::GetRoot<MyGame::Example::Monster>(testrequirednestedflatbuffer()->Data());
1729+
const auto _f = testrequirednestedflatbuffer();
1730+
return _f ? ::flatbuffers::GetRoot<MyGame::Example::Monster>(_f->Data())
1731+
: nullptr;
17261732
}
17271733
const ::flatbuffers::Vector<::flatbuffers::Offset<MyGame::Example::Stat>> *scalar_key_sorted_tables() const {
17281734
return GetPointer<const ::flatbuffers::Vector<::flatbuffers::Offset<MyGame::Example::Stat>> *>(VT_SCALAR_KEY_SORTED_TABLES);

0 commit comments

Comments
 (0)
Please sign in to comment.