Fix leak of entities on duplicate #id

byid_.insert() at IfcParse.cpp is a no-op when the id already exists
(unlike operator[], it doesn't overwrite), even though the adjacent
log message claims the entity is being overwritten. The newly
instantiated duplicate-id entity was therefore never stored anywhere
and leaked.

It can't simply be deleted on insert failure: by that point it's
already been registered in byguid_ (if IfcRoot) and bytype_excl_'s
per-type aggregate, both earlier in the same loop iteration, so
discarding it would leave those maps holding dangling pointers.
Route it into a new owned list instead (same pattern already used
for read_simple_type_instances) so it stays alive for the file's
lifetime but still gets freed on destruction.

Found by fuzzing (fuzzer-3su); repro is crashes/0f486942362e in the
fuzzer repo, minimized to 2 duplicate-id entities out of ~256 total.

Generated with the assistance of an AI coding tool.
This commit is contained in:
Bruno Postle
2026-07-21 14:50:36 +01:00
parent efac8a0ec0
commit f16ba3d26e
2 changed files with 8 additions and 4 deletions
+5 -4
View File
@@ -1661,14 +1661,15 @@ void IfcParse::impl::in_memory_file_storage::read_from_stream(IfcParse::FileRead
bytype_excl_[ty]->push(instance);
}
if (byid_.find(current_id) != byid_.end()) {
// byidentity_[instance->identity()] = instance;
if (!byid_.insert({(uint32_t) current_id, instance }).second) {
std::stringstream ss;
ss << "Overwriting instance with name #" << current_id;
logger().Message(Logger::LOG_WARNING, "SYN", 18, ss.str());
}
// byidentity_[instance->identity()] = instance;
byid_.insert({(uint32_t) current_id, instance });
// insert() is a no-op on a duplicate key; instance is already referenced by byguid_/bytype_excl_ above, so keep it owned here instead of leaking it.
duplicate_id_instances_.emplace_back(instance);
}
// @nb cannot assign to byid_;
// byid_[current_id] = instance;
+3
View File
@@ -199,6 +199,9 @@ namespace IfcParse {
return std::move(read_simple_type_instances);
}
// Entities rejected by byid_.insert() on a duplicate #id; kept alive here since byguid_/bytype_excl_ already reference them.
std::vector<std::unique_ptr<IfcUtil::IfcBaseClass>> duplicate_id_instances_;
IfcParse::IfcSpfLexer* tokens;
std::reference_wrapper<Logger> logger_;
// IfcParse::FileReader* stream;