commit 1f0360db7667f0487b3363da02f6a11ac4048a78
author Devin Moore <devinmoore@google.com> Mon Dec 21 12:12:48 2020 -0800
committer Devin Moore <devinmoore@google.com> Tue Dec 22 23:47:20 2020 +0000
tree b57b1092d8dc88881daf6106c65c757d516df135
parent bc219358f9e01b07064cf1f8426beb566716e8df

Track const reference evaluate results

Previously, the results of handleShift() handleBinaryCommon() and
handleUnary() were not being used to update is_valid_ which allowed for
some overflows to go unnoticed.

Bug: 175990072
Test: atest aidl_unittests aidl_integration_test
Test: aidl_parser_fuzzer tests/corpus/const_overflow
Change-Id: I6e1f8c498ed132ada409335b961a631355fa9427

aidl_const_expressions.cpp

diff --git a/aidl_const_expressions.cpp b/aidl_const_expressions.cpp
index 5509999..801efb2 100644
--- a/aidl_const_expressions.cpp
+++ b/aidl_const_expressions.cpp
@@ -849,7 +849,8 @@
   }
 
 #define CASE_UNARY(__type__) \
-  return handleUnary(*this, op_, static_cast<__type__>(unary_->final_value_), &final_value_);
+  return is_valid_ =         \
+             handleUnary(*this, op_, static_cast<__type__>(unary_->final_value_), &final_value_);
 
   SWITCH_KIND(final_type_, CASE_UNARY, SHOULD_NOT_REACH(); final_type_ = Type::ERROR;
               is_valid_ = false; return false;)
@@ -957,9 +958,10 @@
                       ? promoted        // arithmetic or bitflip operators generates promoted type
                       : Type::BOOLEAN;  // comparison operators generates bool
 
-#define CASE_BINARY_COMMON(__type__)                                                    \
-  return handleBinaryCommon(*this, static_cast<__type__>(left_val_->final_value_), op_, \
-                            static_cast<__type__>(right_val_->final_value_), &final_value_);
+#define CASE_BINARY_COMMON(__type__)                                                        \
+  return is_valid_ =                                                                        \
+             handleBinaryCommon(*this, static_cast<__type__>(left_val_->final_value_), op_, \
+                                static_cast<__type__>(right_val_->final_value_), &final_value_);
 
     SWITCH_KIND(promoted, CASE_BINARY_COMMON, SHOULD_NOT_REACH(); final_type_ = Type::ERROR;
                 is_valid_ = false; return false;)
@@ -979,9 +981,9 @@
       numBits = -numBits;
     }
 
-#define CASE_SHIFT(__type__)                                                       \
-  return handleShift(*this, static_cast<__type__>(left_val_->final_value_), newOp, \
-                     static_cast<__type__>(numBits), &final_value_);
+#define CASE_SHIFT(__type__)                                                                   \
+  return is_valid_ = handleShift(*this, static_cast<__type__>(left_val_->final_value_), newOp, \
+                                 static_cast<__type__>(numBits), &final_value_);
 
     SWITCH_KIND(final_type_, CASE_SHIFT, SHOULD_NOT_REACH(); final_type_ = Type::ERROR;
                 is_valid_ = false; return false;)