From 8ee52c466ff3e1096cc6dff860891185c3a1c63f Mon Sep 17 00:00:00 2001 From: Bruno Postle Date: Sat, 18 Jul 2026 00:39:25 +0100 Subject: [PATCH] Fix null reference bind in header parsing references_to_resolve is never set while parsing header entities, so binding a reference to it was UB, caught by UBSan on any file with a header. Generated with the assistance of an AI coding tool. --- src/ifcparse/IfcSpfHeader.cpp | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/src/ifcparse/IfcSpfHeader.cpp b/src/ifcparse/IfcSpfHeader.cpp index f28c2ea2df..8bcd7499e5 100644 --- a/src/ifcparse/IfcSpfHeader.cpp +++ b/src/ifcparse/IfcSpfHeader.cpp @@ -35,7 +35,13 @@ namespace { parse_context pc; storage->tokens->Next(); storage->load(-1, nullptr, pc, -1); - return pc.construct(boost::none, *storage->references_to_resolve, decl, decl->as_entity()->attribute_count(), -1, logger); + // references_to_resolve is unset while reading the header (header + // entities such as FILE_DESCRIPTION never reference other + // instances), so fall back to a throwaway list instead of + // dereferencing a null pointer. + unresolved_references no_references; + unresolved_references& references = storage->references_to_resolve ? *storage->references_to_resolve : no_references; + return pc.construct(boost::none, references, decl, decl->as_entity()->attribute_count(), -1, logger); } else { // std::unreachable(); return IfcEntityInstanceData(in_memory_attribute_storage(10));