Bug fixes to avoid NULL pointer derefs with malformed programs.

decl.cpp

@@ -171,6 +171,11 @@ Declarator::Declarator(DeclaratorKind dk, SourcePos p)
 void
 Declarator::InitFromDeclSpecs(DeclSpecs *ds) {
     const Type *t = GetType(ds);
+    if (t == NULL) {
+        Assert(m->errorCount > 0);
+        return;
+    }
+
     Symbol *sym = GetSymbol();
     if (sym != NULL) {
         sym->type = t;
@@ -248,8 +253,10 @@ Declarator::GetFunctionInfo(DeclSpecs *ds, std::vector<Symbol *> *funArgs) {
     // already have been added to the symbol table by AddGlobal() by the
     // time we get here.)
     Symbol *funSym = m->symbolTable->LookupFunction(declSym->name.c_str(), type);
-    if (funSym != NULL)
+    if (funSym == NULL)
         // May be NULL due to error earlier in compilation
+        Assert(m->errorCount > 0);
+    else
         funSym->pos = pos;
 
     // Walk down to the declarator for the function.  (We have to get past
@@ -262,7 +269,13 @@ Declarator::GetFunctionInfo(DeclSpecs *ds, std::vector<Symbol *> *funArgs) {
 
     for (unsigned int i = 0; i < d->functionParams.size(); ++i) {
         Symbol *sym = d->GetSymbolForFunctionParameter(i);
-        sym->type = sym->type->ResolveUnboundVariability(Type::Varying);
+        if (sym->type == NULL) {
+            Assert(m->errorCount > 0);
+            continue;
+        }
+        else
+            sym->type = sym->type->ResolveUnboundVariability(Type::Varying);
+
         funArgs->push_back(sym);
     }
 
@@ -379,8 +392,12 @@ Declarator::GetType(const Type *base, DeclSpecs *ds) const {
                 // report this differently than it was originally declared
                 // in the function, but it's not clear that this is a
                 // significant problem.)
-                sym->type = PointerType::GetUniform(at->GetElementType());
+                if (at->GetElementType() == NULL) {
+                    Assert(m->errorCount > 0);
+                    return NULL;
+                }
 
+                sym->type = PointerType::GetUniform(at->GetElementType());
                 // Make sure there are no unsized arrays (other than the
                 // first dimension) in function parameter lists.
                 at = dynamic_cast<const ArrayType *>(at->GetElementType());
@@ -547,11 +564,18 @@ Declaration::GetVariableDeclarations() const {
 
     for (unsigned int i = 0; i < declarators.size(); ++i) {
         Declarator *decl = declarators[i];
-        if (decl == NULL)
+        if (decl == NULL) {
             // Ignore earlier errors
+            Assert(m->errorCount > 0);
             continue;
+        }
 
         Symbol *sym = decl->GetSymbol();
+        if (sym == NULL || sym->type == NULL) {
+            // Ignore errors
+            Assert(m->errorCount > 0);
+            continue;
+        }
         sym->type = sym->type->ResolveUnboundVariability(Type::Varying);
 
         if (sym->type == AtomicType::Void)
@@ -571,11 +595,18 @@ Declaration::DeclareFunctions() {
 
     for (unsigned int i = 0; i < declarators.size(); ++i) {
         Declarator *decl = declarators[i];
-        if (decl == NULL)
+        if (decl == NULL) {
             // Ignore earlier errors
+            Assert(m->errorCount > 0);
             continue;
+        }
 
         Symbol *sym = decl->GetSymbol();
+        if (sym == NULL || sym->type == NULL) {
+            // Ignore errors
+            Assert(m->errorCount > 0);
+            continue;
+        }
         sym->type = sym->type->ResolveUnboundVariability(Type::Varying);
 
         if (dynamic_cast<const FunctionType *>(sym->type) == NULL)

expr.cpp

@@ -2584,6 +2584,11 @@ AssignExpr::TypeCheck() {
     }
 
     const Type *lhsType = lvalue->GetType();
+    if (lhsType == NULL) {
+        Assert(m->errorCount > 0);
+        return NULL;
+    }
+
     if (lhsType->IsConstType()) {
         Error(lvalue->pos, "Can't assign to type \"%s\" on left-hand side of "
               "expression.", lhsType->GetString().c_str());

parse.yy

@@ -521,9 +521,16 @@ constant_expression
 declaration_statement
     : declaration     
     {
-        if ($1->declSpecs->storageClass == SC_TYPEDEF) {
+        if ($1 == NULL) {
+            Assert(m->errorCount > 0);
+            $$ = NULL;
+        }
+        else if ($1->declSpecs->storageClass == SC_TYPEDEF) {
             for (unsigned int i = 0; i < $1->declarators.size(); ++i) {
-                m->AddTypeDef($1->declarators[i]->GetSymbol());
+                if ($1->declarators[i] == NULL)
+                    Assert(m->errorCount > 0);
+                else
+                    m->AddTypeDef($1->declarators[i]->GetSymbol());
             }
             $$ = NULL;
         }
@@ -658,7 +665,6 @@ type_specifier
     : atomic_var_type_specifier { $$ = $1; }
     | TOKEN_TYPE_NAME
       { const Type *t = m->symbolTable->LookupType(yytext); 
-        Assert(t != NULL);
         $$ = t;
       }
     | struct_or_union_specifier { $$ = $1; }
@@ -1618,7 +1624,10 @@ lAddDeclaration(DeclSpecs *ds, Declarator *decl) {
             m->AddFunctionDeclaration(sym, isInline);
         }
         else {
-            sym->type = sym->type->ResolveUnboundVariability(Type::Varying);
+            if (sym->type == NULL)
+                Assert(m->errorCount > 0);
+            else
+                sym->type = sym->type->ResolveUnboundVariability(Type::Varying);
             bool isConst = (ds->typeQualifiers & TYPEQUAL_CONST) != 0;
             m->AddGlobalVariable(sym, decl->initExpr, isConst);
         }
@@ -1647,14 +1656,18 @@ lAddFunctionParams(Declarator *decl) {
             continue;
         Assert(pdecl->declarators.size() == 1);
         Symbol *sym = pdecl->declarators[0]->GetSymbol();
-        sym->type = sym->type->ResolveUnboundVariability(Type::Varying);
+        if (sym == NULL || sym->type == NULL)
-#ifndef NDEBUG
-        bool ok = m->symbolTable->AddVariable(sym);
-        if (ok == false)
             Assert(m->errorCount > 0);
+        else {
+            sym->type = sym->type->ResolveUnboundVariability(Type::Varying);
+#ifndef NDEBUG
+            bool ok = m->symbolTable->AddVariable(sym);
+            if (ok == false)
+                Assert(m->errorCount > 0);
 #else
-        m->symbolTable->AddVariable(sym);
+            m->symbolTable->AddVariable(sym);
 #endif
+        }
     }
 
     // The corresponding pop scope happens in function_definition rules