From f99eb0058b590e29ed7b0264266fd2c2ca6c8faf Mon Sep 17 00:00:00 2001
From: John McFarland <mcfarljm@gmail.com>
Date: Sun, 27 Oct 2019 18:19:42 -0500
Subject: [PATCH] Fix pydoc null pointer dereference with missing arg type

Processing doxygen @param comments for a parameter whose name did not
appear in the function declaration would cause a segfault due to a
null pointer dereference.

Adding test cases for both variadic function (no specified arguments)
and @param comment that references an argument that is not named in
the function prototype.  Both of these cases previously segfaulted.
---
 Examples/test-suite/doxygen_basic_translate.i      | 14 ++++++++++++++
 .../java/doxygen_basic_translate_runme.java        |  7 +++++++
 .../python/doxygen_basic_translate_runme.py        | 10 ++++++++++
 Source/Doxygen/pydoc.cxx                           |  9 ++++-----
 4 files changed, 35 insertions(+), 5 deletions(-)

diff --git a/Examples/test-suite/doxygen_basic_translate.i b/Examples/test-suite/doxygen_basic_translate.i
index da4d80909..47c8e3db1 100644
--- a/Examples/test-suite/doxygen_basic_translate.i
+++ b/Examples/test-suite/doxygen_basic_translate.i
@@ -107,6 +107,20 @@ double Atan2(double y, double x)
     return 0;
 }
 
+/**
+ * @brief Test variadic function
+ * @param ... extra args
+ */
+void function8(...) {
+}
+
+/**
+ * @brief Test unnamed argument
+ * @param baz Description of baz
+ */
+void function9(int) {
+} 
+
 /**
  * Comment at the end of file should be ignored.
  */
diff --git a/Examples/test-suite/java/doxygen_basic_translate_runme.java b/Examples/test-suite/java/doxygen_basic_translate_runme.java
index ab343b560..b4aaf8c71 100644
--- a/Examples/test-suite/java/doxygen_basic_translate_runme.java
+++ b/Examples/test-suite/java/doxygen_basic_translate_runme.java
@@ -94,6 +94,13 @@ public class doxygen_basic_translate_runme {
     		" @param x Horizontal coordinate.\n" +
     		" @return Arc tangent of <code>y/x</code>.\n" +
     		"");
+    wantedComments.put("doxygen_basic_translate.doxygen_basic_translate.function8()",
+		" Test variadic function\n" +
+		"");
+
+    wantedComments.put("doxygen_basic_translate.doxygen_basic_translate.function9(int)",
+		" Test unnamed argument\n" +
+		"");    
 
     // and ask the parser to check comments for us
     System.exit(parser.check(wantedComments));
diff --git a/Examples/test-suite/python/doxygen_basic_translate_runme.py b/Examples/test-suite/python/doxygen_basic_translate_runme.py
index 9ef8dbd52..da31d800a 100644
--- a/Examples/test-suite/python/doxygen_basic_translate_runme.py
+++ b/Examples/test-suite/python/doxygen_basic_translate_runme.py
@@ -70,6 +70,16 @@ Test for a parameter with difficult type
 :type a: :py:class:`Shape`
 :param a: Very strange param"""
 )
+comment_verifier.check(inspect.getdoc(doxygen_basic_translate.function8),
+    """\
+Test variadic function
+:param ...: extra args"""
+)
+comment_verifier.check(inspect.getdoc(doxygen_basic_translate.function9),
+    """\
+Test unnamed argument
+:param baz: Description of baz"""
+)
 
 comment_verifier.check(inspect.getdoc(doxygen_basic_translate.Atan2),
     """\
diff --git a/Source/Doxygen/pydoc.cxx b/Source/Doxygen/pydoc.cxx
index eb489932a..aecdcb746 100644
--- a/Source/Doxygen/pydoc.cxx
+++ b/Source/Doxygen/pydoc.cxx
@@ -418,11 +418,10 @@ std::string PyDocConverter::getParamType(std::string param) {
   ParmList *plist = CopyParmList(Getattr(currentNode, "parms"));
   for (Parm *p = plist; p; p = nextSibling(p)) {
     String *pname = Getattr(p, "name");
-    if (Char(pname) != param)
-      continue;
-
-    type = getPyDocType(p, pname);
-    break;
+    if (pname && Char(pname) == param) {
+      type = getPyDocType(p, pname);
+      break;
+    }
   }
   Delete(plist);
   return type;