Fix use-after-free on annotation parse error
There's a mistake in 442cacfc96f69adce7b55bd28cf07a75fbcb4b65.
It missed to set $$ when AidlAnnotation::Parse fails. When $$ is not
set, it points to the first component of the rule ($1) which is deleted.
Bug: 200010248
Test: aidl_unittests
Change-Id: I8b46af7db44ebcc63ab37340536ad8210af53fb9
diff --git a/aidl_language_y.yy b/aidl_language_y.yy
index 9518579..3078dae 100644
--- a/aidl_language_y.yy
+++ b/aidl_language_y.yy
@@ -772,10 +772,9 @@
annotation
: ANNOTATION {
- auto annot = AidlAnnotation::Parse(loc(@1), $1->GetText(), {}, $1->GetComments());
- if (annot) {
- $$ = annot.release();
- } else {
+ // release() returns nullptr if unique_ptr is empty.
+ $$ = AidlAnnotation::Parse(loc(@1), $1->GetText(), {}, $1->GetComments()).release();
+ if (!$$) {
ps->AddError();
}
delete $1;
diff --git a/aidl_unittest.cpp b/aidl_unittest.cpp
index 782e150..6c8f476 100644
--- a/aidl_unittest.cpp
+++ b/aidl_unittest.cpp
@@ -647,6 +647,13 @@
ASSERT_EQ("IBar", interface->GetDescriptor());
}
+TEST_P(AidlTest, UnknownAnnotation) {
+ const string oneway_method = "package a; @Unknown interface IFoo { }";
+ CaptureStderr();
+ EXPECT_EQ(nullptr, Parse("a/IFoo.aidl", oneway_method, typenames_, GetLanguage()));
+ EXPECT_THAT(GetCapturedStderr(), HasSubstr("not a recognized annotation"));
+}
+
TEST_P(AidlTest, AcceptsOnewayMethod) {
const string oneway_method = "package a; interface IFoo { oneway void f(int a); }";
EXPECT_NE(nullptr, Parse("a/IFoo.aidl", oneway_method, typenames_, GetLanguage()));