Skip to content

TsCodeGenerator crashes when testing empty namespace #8793

@coder7695

Description

@coder7695

The generateEntry method of idl_gen_ts creates new NameSpace() when handling schema with empty namespace but does not delete the NameSpace object on reuse and causes memory leak. Log attached:

=================================================================
==37831==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 32 byte(s) in 1 object(s) allocated from:
    #0 0x5a7eb38a7461 in operator new(unsigned long) (~/flatbuffers/tests/fuzzer/codegen_fuzzer+0x11ce461) (BuildId: b735958c5495c0ec)
    #1 0x5a7eb40579dd in flatbuffers::ts::TsGenerator::generateEntry() ~/flatbuffers/src/idl_gen_ts.cpp:263:18
    #2 0x5a7eb404812d in flatbuffers::ts::TsGenerator::generate() ~/flatbuffers/src/idl_gen_ts.cpp:120:7
    #3 0x5a7eb4046906 in flatbuffers::GenerateTS(flatbuffers::Parser const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&) ~/flatbuffers/src/idl_gen_ts.cpp:2286:20
    #4 0x5a7eb40453c1 in flatbuffers::(anonymous namespace)::TsCodeGenerator::GenerateCode(flatbuffers::Parser const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&) ~/flatbuffers/src/idl_gen_ts.cpp:2310:10
    #5 0x5a7eb38adb6f in LLVMFuzzerTestOneInput ~/flatbuffers/tests/fuzzer/flatbuffers_codegen_fuzzer.cc:139:24
    #6 0x5a7eb37b4c74 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) crtstuff.c
    #7 0x5a7eb37b4369 in fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long, bool, fuzzer::InputInfo*, bool, bool*) crtstuff.c
    #8 0x5a7eb37b5b55 in fuzzer::Fuzzer::MutateAndTestOne() crtstuff.c
    #9 0x5a7eb37b66b5 in fuzzer::Fuzzer::Loop(std::vector<fuzzer::SizedFile, std::allocator<fuzzer::SizedFile>>&) crtstuff.c
    #10 0x5a7eb37a396f in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) crtstuff.c
    #11 0x5a7eb37ce056 in main (~/flatbuffers/tests/fuzzer/codegen_fuzzer+0x10f5056) (BuildId: b735958c5495c0ec)
    #12 0x70199002a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #13 0x70199002a28a in __libc_start_main csu/../csu/libc-start.c:360:3
    #14 0x5a7eb3798954 in _start (~/flatbuffers/tests/fuzzer/codegen_fuzzer+0x10bf954) (BuildId: b735958c5495c0ec)

SUMMARY: AddressSanitizer: 32 byte(s) leaked in 1 allocation(s).
INFO: to ignore leaks on libFuzzer side use -detect_leaks=0.

MS: 1 CopyPart-; base unit: f63a738895d4d93bdd7f04ac25408a8eb7f40546
0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x61,0x74,0x74,0x72,0x69,0x62,0x75,0x74,0x65,0x20,0x74,0x61,0x62,0x6c,0x65,0x3b,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0xa,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,
                      attribute table;                   \012
artifact_prefix='./'; Test unit written to ./leak-605e2fd48a5fc7baa866130a8f605463508c534c
Base64: ICAgICAgICAgICAgICAgICAgICAgIGF0dHJpYnV0ZSB0YWJsZTsgICAgICAgICAgICAgICAgICAgCiAgICAgICAg

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions