#2020·rapidjson

Schema.TestSuite UndefinedBehaviorSanitizer: undefined-behavior

Author: hcoonaCreated Apr 12, 2022Updated Aug 27, 2026
cpp
PointerType schemaRef = GetInvalidSchemaPointer().Append(SchemaType::GetValidateErrorKeyword(kValidateErrorDependencies), &GetInvalidSchemaPointer().GetAllocator());

The allocator here could be nullptr while GetAllocator() must return a reference.

cpp
//! Get the allocator of this pointer.
Allocator& GetAllocator() { return *allocator_; }

Reproduce steps:

bash
git clone https://github.com/Tencent/rapidjson.git && cd rapidjson
git checkout fcb23c2dbf561ec0798529be4f66394d3e4996d8 && git submodule update --init --force
mkdir build && cd build
cmake .. -GNinja -DCMAKE_BUILD_TYPE=Debug -DRAPIDJSON_BUILD_THIRDPARTY_GTEST=ON -DRAPIDJSON_BUILD_CXX17=ON -DRAPIDJSON_BUILD_ASAN=ON -DRAPIDJSON_BUILD_UBSAN=ON -DRAPIDJSON_ENABLE_INSTRUMENTATION_OPT=OFF -DRAPIDJSON_HAS_STDSTRING=ON -DRAPIDJSON_USE_MEMBERSMAP=ON -DRAPIDJSON_BUILD_DOC=OFF -DRAPIDJSON_BUILD_EXAMPLES=OFF -DCMAKE_INSTALL_PREFIX=$PWD/output
ninja unittest
UBSAN_OPTIONS=halt_on_error=true:print_stacktrace=1 bin/unittest --gtest_filter=Schema.TestSuite

Error reporting:

[==========] Running 1 test from 1 test case.
[----------] Global test environment set-up.
[----------] 1 test from Schema
[ RUN      ] Schema.TestSuite
../include/rapidjson/pointer.h:350:41: runtime error: reference binding to null pointer of type 'struct CrtAllocator'
    #0 0x5637cbb16449 in rapidjson::GenericPointer<rapidjson::GenericValue<rapidjson::UTF8<char>, rapidjson::MemoryPoolAllocator<rapidjson::CrtAllocator> >, rapidjson::CrtAllocator>::GetAllocator() ../include/rapidjson/pointer.h:350
    #1 0x5637cbb10fb9 in rapidjson::GenericSchemaValidator<rapidjson::GenericSchemaDocument<rapidjson::GenericValue<rapidjson::UTF8<char>, rapidjson::MemoryPoolAllocator<rapidjson::CrtAllocator> >, rapidjson::CrtAllocator>, rapidjson::BaseReaderHandler<rapidjson::UTF8<char>, void>, rapidjson::MemoryPoolAllocator<rapidjson::CrtAllocator> >::EndMissingDependentProperties(rapidjson::GenericValue<rapidjson::UTF8<char>, rapidjson::CrtAllocator> const&) ../include/rapidjson/schema.h:2261
    #2 0x5637cbac3e73 in rapidjson::internal::Schema<rapidjson::GenericSchemaDocument<rapidjson::GenericValue<rapidjson::UTF8<char>, rapidjson::MemoryPoolAllocator<rapidjson::CrtAllocator> >, rapidjson::CrtAllocator> >::EndObject(rapidjson::internal::SchemaValidationContext<rapidjson::GenericSchemaDocument<rapidjson::GenericValue<rapidjson::UTF8<char>, rapidjson::MemoryPoolAllocator<rapidjson::CrtAllocator> >, rapidjson::CrtAllocator> >&, unsigned int) const ../include/rapidjson/schema.h:1037
    #3 0x5637cba94034 in rapidjson::GenericSchemaValidator<rapidjson::GenericSchemaDocument<rapidjson::GenericValue<rapidjson::UTF8<char>, rapidjson::MemoryPoolAllocator<rapidjson::CrtAllocator> >, rapidjson::CrtAllocator>, rapidjson::BaseReaderHandler<rapidjson::UTF8<char>, void>, rapidjson::MemoryPoolAllocator<rapidjson::CrtAllocator> >::EndObject(unsigned int) ../include/rapidjson/schema.h:2411
    #4 0x5637cba78918 in bool rapidjson::GenericValue<rapidjson::UTF8<char>, rapidjson::MemoryPoolAllocator<rapidjson::CrtAllocator> >::Accept<rapidjson::GenericSchemaValidator<rapidjson::GenericSchemaDocument<rapidjson::GenericValue<rapidjson::UTF8<char>, rapidjson::MemoryPoolAllocator<rapidjson::CrtAllocator> >, rapidjson::CrtAllocator>, rapidjson::BaseReaderHandler<rapidjson::UTF8<char>, void>, rapidjson::MemoryPoolAllocator<rapidjson::CrtAllocator> > >(rapidjson::GenericSchemaValidator<rapidjson::GenericSchemaDocument<rapidjson::GenericValue<rapidjson::UTF8<char>, rapidjson::MemoryPoolAllocator<rapidjson::CrtAllocator> >, rapidjson::CrtAllocator>, rapidjson::BaseReaderHandler<rapidjson::UTF8<char>, void>, rapidjson::MemoryPoolAllocator<rapidjson::CrtAllocator> >&) const (/home/shuaiz/GitEnlistments/github.com/public/rapidjson/build/bin/perftest+0x643918)
    #5 0x5637cba6c15c in Schema_TestSuite_Test::TestBody() ../test/perftest/schematest.cpp:211
    #6 0x5637cbbf5ee1 in void testing::internal::HandleSehExceptionsInMethodIfSupported<testing::Test, void>(testing::Test*, void (testing::Test::*)(), char const*) ../thirdparty/gtest/googletest/src/gtest.cc:2418
    #7 0x5637cbbd70b2 in void testing::internal::HandleExceptionsInMethodIfSupported<testing::Test, void>(testing::Test*, void (testing::Test::*)(), char const*) ../thirdparty/gtest/googletest/src/gtest.cc:2454
    #8 0x5637cbb3a239 in testing::Test::Run() ../thirdparty/gtest/googletest/src/gtest.cc:2492
    #9 0x5637cbb3d865 in testing::TestInfo::Run() ../thirdparty/gtest/googletest/src/gtest.cc:2668
    #10 0x5637cbb408e6 in testing::TestCase::Run() ../thirdparty/gtest/googletest/src/gtest.cc:2786
    #11 0x5637cbb7567f in testing::internal::UnitTestImpl::RunAllTests() ../thirdparty/gtest/googletest/src/gtest.cc:5048
    #12 0x5637cbbfc3c5 in bool testing::internal::HandleSehExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool>(testing::internal::UnitTestImpl*, bool (testing::internal::UnitTestImpl::*)(), char const*) ../thirdparty/gtest/googletest/src/gtest.cc:2418
    #13 0x5637cbbdc4b2 in bool testing::internal::HandleExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool>(testing::internal::UnitTestImpl*, bool (testing::internal::UnitTestImpl::*)(), char const*) ../thirdparty/gtest/googletest/src/gtest.cc:2454
    #14 0x5637cbb6989f in testing::UnitTest::Run() ../thirdparty/gtest/googletest/src/gtest.cc:4664
    #15 0x5637cb9605be in RUN_ALL_TESTS() ../thirdparty/gtest/googletest/include/gtest/gtest.h:2329
    #16 0x5637cb9603a5 in main ../test/perftest/perftest.cpp:23
    #17 0x7fc794cec0b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x240b2)
    #18 0x5637cb96017d in _start (/home/shuaiz/GitEnlistments/github.com/public/rapidjson/build/bin/perftest+0x52b17d)