fix oob read in clangimport AST nodes with fewer than 2 ext tokens (#8939)

GotoStmt and NamespaceDecl in AstNode::createTokens, and
createTokensForCXXRecord, read mExtTokens[mExtTokens.size() - 2] without
checking the node carries two ext tokens. mExtTokens comes from
splitString() of a clang -ast-dump line (read via --clang) and can hold
one or zero entries for a crafted node, so size()-2 wraps around and the
access reads out of bounds. ASAN reports a heap-buffer-overflow at the
GotoStmt site for a dump whose GotoStmt line has a single token
(`\`-GotoStmt 0x3` inside a function body). The three size()-2 accesses
now check the token count first; valid dumps always carry the location
and name tokens so their output is unchanged. crash3 in
testclangimport.cpp covers all three node types.

Happy to add a `Fix #NNNN` reference once a trac ticket exists for this
(I don't have Trac access, so a maintainer would need to create it).

Author: Nussu06

lib/clangimport.cpp

@@ -1139,6 +1139,8 @@ Token *clangimport::AstNode::createTokens(TokenList &tokenList)
         return nullptr;
     }
     if (nodeType == GotoStmt) {
+        if (mExtTokens.size() < 2)
+            return nullptr;
         addtoken(tokenList, "goto");
         addtoken(tokenList, unquote(mExtTokens[mExtTokens.size() - 2]));
         addtoken(tokenList, ";");
@@ -1228,9 +1230,12 @@ Token *clangimport::AstNode::createTokens(TokenList &tokenList)
         if (children.empty())
             return nullptr;
         const Token *defToken = addtoken(tokenList, "namespace");
-        const std::string &s = mExtTokens[mExtTokens.size() - 2];
-        const Token* nameToken = (startsWith(s, "col:") || startsWith(s, "line:")) ?
-                                 addtoken(tokenList, mExtTokens.back()) : nullptr;
+        const Token* nameToken = nullptr;
+        if (mExtTokens.size() >= 2) {
+            const std::string &s = mExtTokens[mExtTokens.size() - 2];
+            if (startsWith(s, "col:") || startsWith(s, "line:"))
+                nameToken = addtoken(tokenList, mExtTokens.back());
+        }
         Scope *scope = createScope(tokenList, ScopeType::eNamespace, children, defToken);
         if (nameToken)
             scope->className = nameToken->str();
@@ -1507,10 +1512,12 @@ void clangimport::AstNode::createTokensForCXXRecord(TokenList &tokenList)
     const bool isStruct = contains(mExtTokens, "struct");
     Token * const classToken = addtoken(tokenList, isStruct ? "struct" : "class");
     std::string className;
-    if (mExtTokens[mExtTokens.size() - 2] == (isStruct?"struct":"class"))
-        className = mExtTokens.back();
-    else
-        className = mExtTokens[mExtTokens.size() - 2];
+    if (mExtTokens.size() >= 2) {
+        if (mExtTokens[mExtTokens.size() - 2] == (isStruct?"struct":"class"))
+            className = mExtTokens.back();
+        else
+            className = mExtTokens[mExtTokens.size() - 2];
+    }
     className += getTemplateParameters();
     /*Token *nameToken =*/ addtoken(tokenList, className);
     // base classes

test/testclangimport.cpp

@@ -142,6 +142,7 @@ class TestClangImport : public TestFixture {
 
         TEST_CASE(crash);
         TEST_CASE(crash2);
+        TEST_CASE(crash3);
         TEST_CASE(nullNodeInvalidLevel);
     }
 
@@ -1429,6 +1430,18 @@ class TestClangImport : public TestFixture {
                             "`-<<<NULL>>>\n";
         ASSERT_EQUALS("void foo ( ) ;", parse(clang));
     }
+
+    void crash3() {
+        // GotoStmt, NamespaceDecl and CXXRecordDecl read mExtTokens[size() - 2]
+        // without checking the node has two ext tokens, so a crafted node with
+        // fewer tokens indexed out of bounds.
+        (void)parse("`-FunctionDecl 0x1 <a.cpp:1:1, col:34> col:6 foo 'void ()'\n"
+                    "  `-CompoundStmt 0x2 <col:12, col:34>\n"
+                    "    `-GotoStmt 0x3\n"); // don't crash
+        (void)parse("`-NamespaceDecl 0x1\n"
+                    "  `-CXXRecordDecl 0x2\n"); // don't crash
+        (void)parse("`-CXXRecordDecl 0x1"); // don't crash
+    }
 };
 
 REGISTER_TEST(TestClangImport)