Security context

Highlights

Memory Corruption: 7 prior fixes. Scrutinize any change in this area.

lib/CodeGen/CGExprCXX.cpp: most-fixed (3 issues). Treat as high-risk during review.

5 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

Integer Overflow: Code generation logic calculating sizes for dynamic array allocations ('new[]') is highly prone to integer overflows that bypass security controls, leading to downstream heap-based buffer overflows. Combining overflow flags with incorrect logical operators or failing to check cookie addition bounds directly caused these vulnerabilities.

Buffer Overflow: Parsing inline assembly or macro definitions frequently exposes fixed-size spelling buffers to overflows. The system must use dynamic, auto-resizing helpers like Preprocessor::getSpelling instead of raw-pointer bounds calculations or fixed-size buffers.

Use After Free: Recursive type evaluation and lookup container iteration are prone to invalidating local references. Modifications or code-completion triggers that mutate backing containers (like MemoizedTypeInfo storage or lookup iterators) mid-loop create severe use-after-free risks.