Compare commits

...

2 Commits

Author SHA1 Message Date
Bruno Postle 0e94c69087 Simplify tokens_owner cleanup in read_from_stream per review
Drop the justification comment and the manual reset/nullptr pair;
letting the unique_ptr go out of scope at function exit already frees
the lexer on every return path.

Generated with the assistance of an AI coding tool.
2026-07-19 21:21:27 +01:00
Bruno Postle f54724502a Fix leak of IfcSpfLexer when read_from_stream returns early or throws
tokens was a raw new'd pointer only freed at the very end of
in_memory_file_storage::read_from_stream(). Every early return along the
way (e.g. NO_HEADER / UNSUPPORTED_SCHEMA / no matching schema, which is
almost any malformed input) skipped that delete and leaked it, along with
whatever exceptions escaping readInstance() during the scan loop.

Own it via a local unique_ptr for the duration of the function instead, so
every exit path frees it.

Found via fuzzing (see the ifcfuzz harness in src/ifcfuzz/).
2026-07-18 18:04:46 +01:00
+2 -3
View File
@@ -1584,7 +1584,8 @@ void IfcParse::impl::in_memory_file_storage::read_from_stream(IfcParse::FileRead
return;
}
tokens = new IfcSpfLexer(s, logger());
std::unique_ptr<IfcSpfLexer> tokens_owner(new IfcSpfLexer(s, logger()));
tokens = tokens_owner.get();
std::vector<std::string> schemas;
@@ -1689,8 +1690,6 @@ void IfcParse::impl::in_memory_file_storage::read_from_stream(IfcParse::FileRead
logger().Status("\rDone scanning file ");
delete tokens;
if (good_ != file_open_status::SUCCESS) {
return;
}