[clang-tidy] clang-tidy bugprone-misplaced-operator-in-strlen-in-alloc crashes on new int with missing array size

[hongtaihu]

This input is generated by a fuzzer.

void *f() { return new int[](); }

use

--checks='-*,bugprone-misplaced-operator-in-strlen-in-alloc' 

https://godbolt.org/z/6n6Yc3hfs

PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace and instructions to reproduce the bug.
Stack dump:
0.	Program arguments: /clang-tidy --checks=-*,bugprone-misplaced-operator-in-strlen-in-alloc <source>
1.	<eof> parser at end of file
2.	ASTMatcher: Matching 'bugprone-misplaced-operator-in-strlen-in-alloc' against:
	CXXNewExpr : <<source>:1:20, col:30>
 #0 0x0000000005027588 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/clang-tidy+0x5027588)
 #1 0x000000000502462d SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
 #2 0x000076a5d4045330 (/lib/x86_64-linux-gnu/libc.so.6+0x45330)
 #3 0x0000000003a248b0 clang::ASTNodeKind::getFromNode(clang::Stmt const&) (/clang-tidy+0x3a248b0)
 #4 0x0000000000c3a428 clang::ast_matchers::internal::matcher_hasArraySize0Matcher::matches(clang::CXXNewExpr const&, clang::ast_matchers::internal::ASTMatchFinder*, clang::ast_matchers::internal::BoundNodesTreeBuilder*) const (/clang-tidy+0xc3a428)
 #5 0x00000000038daaaf clang::ast_matchers::internal::DynTypedMatcher::matchesNoKindCheck(clang::DynTypedNode const&, clang::ast_matchers::internal::ASTMatchFinder*, clang::ast_matchers::internal::BoundNodesTreeBuilder*) const (/clang-tidy+0x38daaaf)
 #6 0x00000000038dad3b clang::ast_matchers::internal::(anonymous namespace)::VariadicMatcher<&clang::ast_matchers::internal::allOfVariadicOperator(clang::DynTypedNode const&, clang::ast_matchers::internal::ASTMatchFinder*, clang::ast_matchers::internal::BoundNodesTreeBuilder*, llvm::ArrayRef<clang::ast_matchers::internal::DynTypedMatcher>)>::dynMatches(clang::DynTypedNode const&, clang::ast_matchers::internal::ASTMatchFinder*, clang::ast_matchers::internal::BoundNodesTreeBuilder*) const ASTMatchersInternal.cpp:0:0
 #7 0x00000000038dbd41 clang::ast_matchers::internal::(anonymous namespace)::IdDynMatcher::dynMatches(clang::DynTypedNode const&, clang::ast_matchers::internal::ASTMatchFinder*, clang::ast_matchers::internal::BoundNodesTreeBuilder*) const ASTMatchersInternal.cpp:0:0
 #8 0x00000000038dae32 clang::ast_matchers::internal::DynTypedMatcher::matches(clang::DynTypedNode const&, clang::ast_matchers::internal::ASTMatchFinder*, clang::ast_matchers::internal::BoundNodesTreeBuilder*) const (/clang-tidy+0x38dae32)
 #9 0x0000000000c65628 clang::ast_matchers::internal::TraversalMatcher<clang::Stmt>::matches(clang::Stmt const&, clang::ast_matchers::internal::ASTMatchFinder*, clang::ast_matchers::internal::BoundNodesTreeBuilder*) const (/clang-tidy+0xc65628)
#10 0x00000000038dae32 clang::ast_matchers::internal::DynTypedMatcher::matches(clang::DynTypedNode const&, clang::ast_matchers::internal::ASTMatchFinder*, clang::ast_matchers::internal::BoundNodesTreeBuilder*) const (/clang-tidy+0x38dae32)
#11 0x00000000038855e6 clang::ast_matchers::internal::(anonymous namespace)::MatchASTVisitor::matchWithFilter(clang::DynTypedNode const&) ASTMatchFinder.cpp:0:0
#12 0x00000000038c0bc5 clang::ast_matchers::internal::(anonymous namespace)::MatchASTVisitor::TraverseStmt(clang::Stmt*, llvm::SmallVectorImpl<llvm::PointerIntPair<clang::Stmt*, 1u, bool, llvm::PointerLikeTypeTraits<clang::Stmt*>, llvm::PointerIntPairInfo<clang::Stmt*, 1u, llvm::PointerLikeTypeTraits<clang::Stmt*>>>>*) ASTMatchFinder.cpp:0:0
#13 0x00000000038c425e clang::RecursiveASTVisitor<clang::ast_matchers::internal::(anonymous namespace)::MatchASTVisitor>::TraverseImplicitCastExpr(clang::ImplicitCastExpr*, llvm::SmallVectorImpl<llvm::PointerIntPair<clang::Stmt*, 1u, bool, llvm::PointerLikeTypeTraits<clang::Stmt*>, llvm::PointerIntPairInfo<clang::Stmt*, 1u, llvm::PointerLikeTypeTraits<clang::Stmt*>>>>*) ASTMatchFinder.cpp:0:0
#14 0x00000000038be2c1 clang::RecursiveASTVisitor<clang::ast_matchers::internal::(anonymous namespace)::MatchASTVisitor>::dataTraverseNode(clang::Stmt*, llvm::SmallVectorImpl<llvm::PointerIntPair<clang::Stmt*, 1u, bool, llvm::PointerLikeTypeTraits<clang::Stmt*>, llvm::PointerIntPairInfo<clang::Stmt*, 1u, llvm::PointerLikeTypeTraits<clang::Stmt*>>>>*) ASTMatchFinder.cpp:0:0
#15 0x00000000038c0b18 clang::RecursiveASTVisitor<clang::ast_matchers::internal::(anonymous namespace)::MatchASTVisitor>::TraverseStmt(clang::Stmt*, llvm::SmallVectorImpl<llvm::PointerIntPair<clang::Stmt*, 1u, bool, llvm::PointerLikeTypeTraits<clang::Stmt*>, llvm::PointerIntPairInfo<clang::Stmt*, 1u, llvm::PointerLikeTypeTraits<clang::Stmt*>>>>*) ASTMatchFinder.cpp:0:0
#16 0x00000000038c601d clang::ast_matchers::internal::(anonymous namespace)::MatchASTVisitor::TraverseStmt(clang::Stmt*, llvm::SmallVectorImpl<llvm::PointerIntPair<clang::Stmt*, 1u, bool, llvm::PointerLikeTypeTraits<clang::Stmt*>, llvm::PointerIntPairInfo<clang::Stmt*, 1u, llvm::PointerLikeTypeTraits<clang::Stmt*>>>>*) (.constprop.0) ASTMatchFinder.cpp:0:0
#17 0x00000000038d0334 clang::RecursiveASTVisitor<clang::ast_matchers::internal::(anonymous namespace)::MatchASTVisitor>::TraverseFunctionHelper(clang::FunctionDecl*) ASTMatchFinder.cpp:0:0
#18 0x00000000038bc070 clang::RecursiveASTVisitor<clang::ast_matchers::internal::(anonymous namespace)::MatchASTVisitor>::TraverseDecl(clang::Decl*) ASTMatchFinder.cpp:0:0
#19 0x00000000038bc648 clang::ast_matchers::internal::(anonymous namespace)::MatchASTVisitor::TraverseDecl(clang::Decl*) ASTMatchFinder.cpp:0:0
#20 0x00000000038bd036 clang::RecursiveASTVisitor<clang::ast_matchers::internal::(anonymous namespace)::MatchASTVisitor>::TraverseDeclContextHelper(clang::DeclContext*) (.part.0) ASTMatchFinder.cpp:0:0
#21 0x00000000038c9782 clang::RecursiveASTVisitor<clang::ast_matchers::internal::(anonymous namespace)::MatchASTVisitor>::TraverseTranslationUnitDecl(clang::TranslationUnitDecl*) ASTMatchFinder.cpp:0:0
#22 0x00000000038bc648 clang::ast_matchers::internal::(anonymous namespace)::MatchASTVisitor::TraverseDecl(clang::Decl*) ASTMatchFinder.cpp:0:0
#23 0x00000000038bcadc clang::ast_matchers::MatchFinder::matchAST(clang::ASTContext&) (/clang-tidy+0x38bcadc)
#24 0x0000000002742ea8 clang::MultiplexConsumer::HandleTranslationUnit(clang::ASTContext&) (/clang-tidy+0x2742ea8)
#25 0x000000000294b04c clang::ParseAST(clang::Sema&, bool, bool) (/clang-tidy+0x294b04c)
#26 0x00000000026fece1 clang::FrontendAction::Execute() (/clang-tidy+0x26fece1)
#27 0x000000000268fd75 clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/clang-tidy+0x268fd75)
#28 0x0000000001c67407 clang::tooling::FrontendActionFactory::runInvocation(std::shared_ptr<clang::CompilerInvocation>, clang::FileManager*, std::shared_ptr<clang::PCHContainerOperations>, clang::DiagnosticConsumer*) (/clang-tidy+0x1c67407)
#29 0x0000000001c106a7 clang::tidy::runClangTidy(clang::tidy::ClangTidyContext&, clang::tooling::CompilationDatabase const&, llvm::ArrayRef<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>, llvm::IntrusiveRefCntPtr<llvm::vfs::OverlayFileSystem>, bool, bool, llvm::StringRef, bool)::ActionFactory::runInvocation(std::shared_ptr<clang::CompilerInvocation>, clang::FileManager*, std::shared_ptr<clang::PCHContainerOperations>, clang::DiagnosticConsumer*) ClangTidy.cpp:0:0
#30 0x0000000001c5fd3c clang::tooling::ToolInvocation::runInvocation(char const*, clang::driver::Compilation*, std::shared_ptr<clang::CompilerInvocation>, std::shared_ptr<clang::PCHContainerOperations>) (/clang-tidy+0x1c5fd3c)
#31 0x0000000001c62e98 clang::tooling::ToolInvocation::run() (/clang-tidy+0x1c62e98)
#32 0x0000000001c655ec clang::tooling::ClangTool::run(clang::tooling::ToolAction*) (/clang-tidy+0x1c655ec)
#33 0x0000000001c11d91 clang::tidy::runClangTidy(clang::tidy::ClangTidyContext&, clang::tooling::CompilationDatabase const&, llvm::ArrayRef<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>, llvm::IntrusiveRefCntPtr<llvm::vfs::OverlayFileSystem>, bool, bool, llvm::StringRef, bool) (/clang-tidy+0x1c11d91)
#34 0x0000000000c38388 clang::tidy::clangTidyMain(int, char const**) (/clang-tidy+0xc38388)
#35 0x000076a5d402a1ca (/lib/x86_64-linux-gnu/libc.so.6+0x2a1ca)
#36 0x000076a5d402a28b __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28b)
#37 0x0000000000c2a665 _start (/clang-tidy+0xc2a665)
Program terminated with signal: SIGSEGV

[llvmorg-github-actions]

@llvm/issue-subscribers-clang-tidy

Author: Macro Terra (hongtaihu)

Details

This input is generated by a fuzzer. ```cxx void *f() { return new int[](); } ```

use

--checks='-*,bugprone-misplaced-operator-in-strlen-in-alloc' 

https://godbolt.org/z/6n6Yc3hfs

PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace and instructions to reproduce the bug.
Stack dump:
0.	Program arguments: /clang-tidy --checks=-*,bugprone-misplaced-operator-in-strlen-in-alloc <source>
1.	<eof> parser at end of file
2.	ASTMatcher: Matching 'bugprone-misplaced-operator-in-strlen-in-alloc' against:
	CXXNewExpr : <<source>:1:20, col:30>
 #<!-- -->0 0x0000000005027588 llvm::sys::PrintStackTrace(llvm::raw_ostream&amp;, int) (/clang-tidy+0x5027588)
 #<!-- -->1 0x000000000502462d SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
 #<!-- -->2 0x000076a5d4045330 (/lib/x86_64-linux-gnu/libc.so.6+0x45330)
 #<!-- -->3 0x0000000003a248b0 clang::ASTNodeKind::getFromNode(clang::Stmt const&amp;) (/clang-tidy+0x3a248b0)
 #<!-- -->4 0x0000000000c3a428 clang::ast_matchers::internal::matcher_hasArraySize0Matcher::matches(clang::CXXNewExpr const&amp;, clang::ast_matchers::internal::ASTMatchFinder*, clang::ast_matchers::internal::BoundNodesTreeBuilder*) const (/clang-tidy+0xc3a428)
 #<!-- -->5 0x00000000038daaaf clang::ast_matchers::internal::DynTypedMatcher::matchesNoKindCheck(clang::DynTypedNode const&amp;, clang::ast_matchers::internal::ASTMatchFinder*, clang::ast_matchers::internal::BoundNodesTreeBuilder*) const (/clang-tidy+0x38daaaf)
 #<!-- -->6 0x00000000038dad3b clang::ast_matchers::internal::(anonymous namespace)::VariadicMatcher&lt;&amp;clang::ast_matchers::internal::allOfVariadicOperator(clang::DynTypedNode const&amp;, clang::ast_matchers::internal::ASTMatchFinder*, clang::ast_matchers::internal::BoundNodesTreeBuilder*, llvm::ArrayRef&lt;clang::ast_matchers::internal::DynTypedMatcher&gt;)&gt;::dynMatches(clang::DynTypedNode const&amp;, clang::ast_matchers::internal::ASTMatchFinder*, clang::ast_matchers::internal::BoundNodesTreeBuilder*) const ASTMatchersInternal.cpp:0:0
 #<!-- -->7 0x00000000038dbd41 clang::ast_matchers::internal::(anonymous namespace)::IdDynMatcher::dynMatches(clang::DynTypedNode const&amp;, clang::ast_matchers::internal::ASTMatchFinder*, clang::ast_matchers::internal::BoundNodesTreeBuilder*) const ASTMatchersInternal.cpp:0:0
 #<!-- -->8 0x00000000038dae32 clang::ast_matchers::internal::DynTypedMatcher::matches(clang::DynTypedNode const&amp;, clang::ast_matchers::internal::ASTMatchFinder*, clang::ast_matchers::internal::BoundNodesTreeBuilder*) const (/clang-tidy+0x38dae32)
 #<!-- -->9 0x0000000000c65628 clang::ast_matchers::internal::TraversalMatcher&lt;clang::Stmt&gt;::matches(clang::Stmt const&amp;, clang::ast_matchers::internal::ASTMatchFinder*, clang::ast_matchers::internal::BoundNodesTreeBuilder*) const (/clang-tidy+0xc65628)
#<!-- -->10 0x00000000038dae32 clang::ast_matchers::internal::DynTypedMatcher::matches(clang::DynTypedNode const&amp;, clang::ast_matchers::internal::ASTMatchFinder*, clang::ast_matchers::internal::BoundNodesTreeBuilder*) const (/clang-tidy+0x38dae32)
#<!-- -->11 0x00000000038855e6 clang::ast_matchers::internal::(anonymous namespace)::MatchASTVisitor::matchWithFilter(clang::DynTypedNode const&amp;) ASTMatchFinder.cpp:0:0
#<!-- -->12 0x00000000038c0bc5 clang::ast_matchers::internal::(anonymous namespace)::MatchASTVisitor::TraverseStmt(clang::Stmt*, llvm::SmallVectorImpl&lt;llvm::PointerIntPair&lt;clang::Stmt*, 1u, bool, llvm::PointerLikeTypeTraits&lt;clang::Stmt*&gt;, llvm::PointerIntPairInfo&lt;clang::Stmt*, 1u, llvm::PointerLikeTypeTraits&lt;clang::Stmt*&gt;&gt;&gt;&gt;*) ASTMatchFinder.cpp:0:0
#<!-- -->13 0x00000000038c425e clang::RecursiveASTVisitor&lt;clang::ast_matchers::internal::(anonymous namespace)::MatchASTVisitor&gt;::TraverseImplicitCastExpr(clang::ImplicitCastExpr*, llvm::SmallVectorImpl&lt;llvm::PointerIntPair&lt;clang::Stmt*, 1u, bool, llvm::PointerLikeTypeTraits&lt;clang::Stmt*&gt;, llvm::PointerIntPairInfo&lt;clang::Stmt*, 1u, llvm::PointerLikeTypeTraits&lt;clang::Stmt*&gt;&gt;&gt;&gt;*) ASTMatchFinder.cpp:0:0
#<!-- -->14 0x00000000038be2c1 clang::RecursiveASTVisitor&lt;clang::ast_matchers::internal::(anonymous namespace)::MatchASTVisitor&gt;::dataTraverseNode(clang::Stmt*, llvm::SmallVectorImpl&lt;llvm::PointerIntPair&lt;clang::Stmt*, 1u, bool, llvm::PointerLikeTypeTraits&lt;clang::Stmt*&gt;, llvm::PointerIntPairInfo&lt;clang::Stmt*, 1u, llvm::PointerLikeTypeTraits&lt;clang::Stmt*&gt;&gt;&gt;&gt;*) ASTMatchFinder.cpp:0:0
#<!-- -->15 0x00000000038c0b18 clang::RecursiveASTVisitor&lt;clang::ast_matchers::internal::(anonymous namespace)::MatchASTVisitor&gt;::TraverseStmt(clang::Stmt*, llvm::SmallVectorImpl&lt;llvm::PointerIntPair&lt;clang::Stmt*, 1u, bool, llvm::PointerLikeTypeTraits&lt;clang::Stmt*&gt;, llvm::PointerIntPairInfo&lt;clang::Stmt*, 1u, llvm::PointerLikeTypeTraits&lt;clang::Stmt*&gt;&gt;&gt;&gt;*) ASTMatchFinder.cpp:0:0
#<!-- -->16 0x00000000038c601d clang::ast_matchers::internal::(anonymous namespace)::MatchASTVisitor::TraverseStmt(clang::Stmt*, llvm::SmallVectorImpl&lt;llvm::PointerIntPair&lt;clang::Stmt*, 1u, bool, llvm::PointerLikeTypeTraits&lt;clang::Stmt*&gt;, llvm::PointerIntPairInfo&lt;clang::Stmt*, 1u, llvm::PointerLikeTypeTraits&lt;clang::Stmt*&gt;&gt;&gt;&gt;*) (.constprop.0) ASTMatchFinder.cpp:0:0
#<!-- -->17 0x00000000038d0334 clang::RecursiveASTVisitor&lt;clang::ast_matchers::internal::(anonymous namespace)::MatchASTVisitor&gt;::TraverseFunctionHelper(clang::FunctionDecl*) ASTMatchFinder.cpp:0:0
#<!-- -->18 0x00000000038bc070 clang::RecursiveASTVisitor&lt;clang::ast_matchers::internal::(anonymous namespace)::MatchASTVisitor&gt;::TraverseDecl(clang::Decl*) ASTMatchFinder.cpp:0:0
#<!-- -->19 0x00000000038bc648 clang::ast_matchers::internal::(anonymous namespace)::MatchASTVisitor::TraverseDecl(clang::Decl*) ASTMatchFinder.cpp:0:0
#<!-- -->20 0x00000000038bd036 clang::RecursiveASTVisitor&lt;clang::ast_matchers::internal::(anonymous namespace)::MatchASTVisitor&gt;::TraverseDeclContextHelper(clang::DeclContext*) (.part.0) ASTMatchFinder.cpp:0:0
#<!-- -->21 0x00000000038c9782 clang::RecursiveASTVisitor&lt;clang::ast_matchers::internal::(anonymous namespace)::MatchASTVisitor&gt;::TraverseTranslationUnitDecl(clang::TranslationUnitDecl*) ASTMatchFinder.cpp:0:0
#<!-- -->22 0x00000000038bc648 clang::ast_matchers::internal::(anonymous namespace)::MatchASTVisitor::TraverseDecl(clang::Decl*) ASTMatchFinder.cpp:0:0
#<!-- -->23 0x00000000038bcadc clang::ast_matchers::MatchFinder::matchAST(clang::ASTContext&amp;) (/clang-tidy+0x38bcadc)
#<!-- -->24 0x0000000002742ea8 clang::MultiplexConsumer::HandleTranslationUnit(clang::ASTContext&amp;) (/clang-tidy+0x2742ea8)
#<!-- -->25 0x000000000294b04c clang::ParseAST(clang::Sema&amp;, bool, bool) (/clang-tidy+0x294b04c)
#<!-- -->26 0x00000000026fece1 clang::FrontendAction::Execute() (/clang-tidy+0x26fece1)
#<!-- -->27 0x000000000268fd75 clang::CompilerInstance::ExecuteAction(clang::FrontendAction&amp;) (/clang-tidy+0x268fd75)
#<!-- -->28 0x0000000001c67407 clang::tooling::FrontendActionFactory::runInvocation(std::shared_ptr&lt;clang::CompilerInvocation&gt;, clang::FileManager*, std::shared_ptr&lt;clang::PCHContainerOperations&gt;, clang::DiagnosticConsumer*) (/clang-tidy+0x1c67407)
#<!-- -->29 0x0000000001c106a7 clang::tidy::runClangTidy(clang::tidy::ClangTidyContext&amp;, clang::tooling::CompilationDatabase const&amp;, llvm::ArrayRef&lt;std::__cxx11::basic_string&lt;char, std::char_traits&lt;char&gt;, std::allocator&lt;char&gt;&gt;&gt;, llvm::IntrusiveRefCntPtr&lt;llvm::vfs::OverlayFileSystem&gt;, bool, bool, llvm::StringRef, bool)::ActionFactory::runInvocation(std::shared_ptr&lt;clang::CompilerInvocation&gt;, clang::FileManager*, std::shared_ptr&lt;clang::PCHContainerOperations&gt;, clang::DiagnosticConsumer*) ClangTidy.cpp:0:0
#<!-- -->30 0x0000000001c5fd3c clang::tooling::ToolInvocation::runInvocation(char const*, clang::driver::Compilation*, std::shared_ptr&lt;clang::CompilerInvocation&gt;, std::shared_ptr&lt;clang::PCHContainerOperations&gt;) (/clang-tidy+0x1c5fd3c)
#<!-- -->31 0x0000000001c62e98 clang::tooling::ToolInvocation::run() (/clang-tidy+0x1c62e98)
#<!-- -->32 0x0000000001c655ec clang::tooling::ClangTool::run(clang::tooling::ToolAction*) (/clang-tidy+0x1c655ec)
#<!-- -->33 0x0000000001c11d91 clang::tidy::runClangTidy(clang::tidy::ClangTidyContext&amp;, clang::tooling::CompilationDatabase const&amp;, llvm::ArrayRef&lt;std::__cxx11::basic_string&lt;char, std::char_traits&lt;char&gt;, std::allocator&lt;char&gt;&gt;&gt;, llvm::IntrusiveRefCntPtr&lt;llvm::vfs::OverlayFileSystem&gt;, bool, bool, llvm::StringRef, bool) (/clang-tidy+0x1c11d91)
#<!-- -->34 0x0000000000c38388 clang::tidy::clangTidyMain(int, char const**) (/clang-tidy+0xc38388)
#<!-- -->35 0x000076a5d402a1ca (/lib/x86_64-linux-gnu/libc.so.6+0x2a1ca)
#<!-- -->36 0x000076a5d402a28b __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28b)
#<!-- -->37 0x0000000000c2a665 _start (/clang-tidy+0xc2a665)
Program terminated with signal: SIGSEGV