[Octave-bug-tracker] [bug #60882] error parsing command syntax

[Markus Mützel]

Follow-up Comment #46, bug #60882 (project octave):

Code scanning on GitHub pointed to a possible use after free issue with one of
the changes from here:
In libinterp/parse-tree/oct-parse.yy lines 3473ff:

            if (parfor)
              {
                delete lhs;
                delete expr;
                delete maxproc;
                delete body;

                bison_error ("invalid syntax for parfor statement");
              }

            m_lexer.mark_as_variables (lhs->variable_names ());



If `parfor` is true, `lhs` is deleted (`bison_error` is not noreturn). In that
case, lhs would still be dereferenced by `lhs->variable_names ()`.

Should `m_lexer.mark_as_variables (lhs->variable_names ());` be in the else
branch of `if (parfor)`? Or should that line be executed before `lhs` is
deleted?



    _______________________________________________________

Reply to this item at:

  <https://savannah.gnu.org/bugs/?60882>

_______________________________________________
Message sent via Savannah
https://savannah.gnu.org/