llvm-undname: Fix nullptr deref on invalid conversion operator names in template args
A ConversionOperatorIdentifierNode has a TargetType which is read when
printing it, but if the ConversionOperatorIdentifierNode appears in a
template argument there's nothing that can provide the TargetType.
Normally the COIN is a symbol (leaf) name and takes its TargetType from the
symbol's type, but in a template argument context the COIN can only be
either a non-leaf name piece or a type, and must hence be invalid.
Similar to the COIN check in demangleDeclarator().
Found by oss-fuzz.
llvm-svn: 358421
diff --git a/llvm/lib/Demangle/MicrosoftDemangle.cpp b/llvm/lib/Demangle/MicrosoftDemangle.cpp
index 2b41c00..c3bdfa2 100644
--- a/llvm/lib/Demangle/MicrosoftDemangle.cpp
+++ b/llvm/lib/Demangle/MicrosoftDemangle.cpp
@@ -947,8 +947,17 @@
if (Error)
return nullptr;
- if (NBB & NBB_Template)
+ if (NBB & NBB_Template) {
+ // NBB_Template is only set for types and non-leaf names ("a::" in "a::b").
+ // A conversion operator only makes sense in a leaf name , so reject it in
+ // NBB_Template contexts.
+ if (Identifier->kind() == NodeKind::ConversionOperatorIdentifier) {
+ Error = true;
+ return nullptr;
+ }
+
memorizeIdentifier(Identifier);
+ }
return Identifier;
}