Use after free in Macro::expand() for data freed in Macro::expandHashHash()

[Barro]

Following code leads into heap-use-after-free error in Macro::expand() function:

#define hash_hash # # #
#define join inc hash_hash
join

This results in following (partial) AddressSanitizer stack backtrace:

==29361==ERROR: AddressSanitizer: heap-use-after-free ...
READ of size 8 at 0x60b000009b38 thread T0
    #0 0x52c7d4 in simplecpp::Macro::expand(...) const simplecpp.cpp:1329:60
...
freed by thread T0 here:
    #0 0x4fde00 in operator delete(void*) llvm/projects/compiler-rt/lib/asan/asan_new_delete.cc:110
    #1 0x52efd7 in simplecpp::Macro::expandHashHash(...) const simplecpp.cpp:1527:13
    #2 0x52c17b in simplecpp::Macro::expand(...) const simplecpp.cpp:1321:23
...

This can be detected by AddressSanitizer and Valgrind (with --track-origins=yes command line switch). Attached the full backtraces from AddressSanitizer and Valgrind runs:

use-after-free-macro-expand-expandhashhash-asan.txt
use-after-free-macro-expand-expandhashhash-valgrind.txt

This happens with simplecpp revision d1c995c

[hexcoder-]

This bug is related to simplecpp misparsing

#define x # #
x

which gives

test.c:1: syntax error: failed to expand 'x', Invalid ## usage when expanding 'x'.

but should give
# #

# # is to be treated differently from ##.

[hexcoder-]

The original problem is that in simplecpp.cpp in method
Macro::expand(TokenList * const output, const Location &loc, const Token * const nameTokInst, const std::map<TokenString,Macro> &macros, std::set<TokenString> expandedmacros)
in line 1411
Token * const output_end_1 = output->back();
a pointer is set to the last token in output tokens, which is then deleted in expandHashHash, line 1673.

If this could/would be detected, one could set output_end_1 = nullptr;, but this is not the case here.

Despite the token being deleted from output and freed, later in line 1456, it is dereferenced
for (Token *tok = output_end_1 ? output_end_1->next : output->front(); tok; tok = tok->next) {.

This triggers the 'use after free' message.

[danmar]

Fixed by e6d9457