Add iterator safety check in DoxygenParser::parse

If the code called by DoxygenParser::parse does not behave correctly,
it may move the iterator m_tokenListIt past the value endParsingIndex.
This was not caught by the previous checks and could lead to
dereferencing an invalid m_tokenListIt iterator value (and segfault).
This is now protected against by using a less than check in the while
loop instead of not equals.  A warning is also printed if
endParsingIndex is exceeded.
This commit is contained in:
John McFarland 2019-07-06 11:07:50 -05:00
commit 841d4b5fb9
2 changed files with 8 additions and 1 deletions

View file

@ -971,7 +971,9 @@ DoxygenEntityList DoxygenParser::parse(TokenListCIt endParsingIndex, const Token
std::string currPlainstringCommandType = root ? "partofdescription" : "plainstd::string";
DoxygenEntityList aNewList;
while (m_tokenListIt != endParsingIndex) {
// Less than check (instead of not equal) is a safeguard in case the
// iterator is incremented past the end
while (m_tokenListIt < endParsingIndex) {
Token currToken = *m_tokenListIt;
@ -988,6 +990,10 @@ DoxygenEntityList DoxygenParser::parse(TokenListCIt endParsingIndex, const Token
addCommand(currPlainstringCommandType, tokList, aNewList);
}
// If addCommand above misbehaves, it can move the iterator past endParsingIndex
if (m_tokenListIt > endParsingIndex)
printListError(WARN_DOXYGEN_UNEXPECTED_ITERATOR_VALUE, "Unexpected iterator value in DoxygenParser::parse");
if (endParsingIndex != tokList.end() && m_tokenListIt == tokList.end()) {
// this could happen if we can't reach the original endParsingIndex
printListError(WARN_DOXYGEN_UNEXPECTED_END_OF_COMMENT, "Unexpected end of Doxygen comment encountered.");

View file

@ -221,6 +221,7 @@
#define WARN_DOXYGEN_HTML_ERROR 563
#define WARN_DOXYGEN_COMMAND_ERROR 564
#define WARN_DOXYGEN_UNKNOWN_CHARACTER 565
#define WARN_DOXYGEN_UNEXPECTED_ITERATOR_VALUE 566
/* -- Reserved (600-799) -- */