mirror of
https://github.com/IfcOpenShell/IfcOpenShell.git
synced 2026-08-05 23:41:44 +00:00
Bruno Postle
f16ba3d26e
byid_.insert() at IfcParse.cpp is a no-op when the id already exists (unlike operator[], it doesn't overwrite), even though the adjacent log message claims the entity is being overwritten. The newly instantiated duplicate-id entity was therefore never stored anywhere and leaked. It can't simply be deleted on insert failure: by that point it's already been registered in byguid_ (if IfcRoot) and bytype_excl_'s per-type aggregate, both earlier in the same loop iteration, so discarding it would leave those maps holding dangling pointers. Route it into a new owned list instead (same pattern already used for read_simple_type_instances) so it stays alive for the file's lifetime but still gets freed on destruction. Found by fuzzing (fuzzer-3su); repro is crashes/0f486942362e in the fuzzer repo, minimized to 2 duplicate-id entities out of ~256 total. Generated with the assistance of an AI coding tool.