From 2c300a4c0a245137693d8946a4d5ecb8685f46be Mon Sep 17 00:00:00 2001 From: Joerg Bornemann Date: Wed, 8 Oct 2025 16:41:34 +0200 Subject: [PATCH] Fix out-of-bounds read on empty gcc-style depfile If a gcc dep file is read that contains no dependencies, cmReadGccDepfile returns a valid std::optional containing an empty vector. Check at the call sites in cmDependsCompiler whether the vector is empty before trying to access the vector's elements. Fixes: #27270 --- Source/cmDependsCompiler.cxx | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/Source/cmDependsCompiler.cxx b/Source/cmDependsCompiler.cxx index c3f6dceaef..974b7d1f98 100644 --- a/Source/cmDependsCompiler.cxx +++ b/Source/cmDependsCompiler.cxx @@ -96,9 +96,9 @@ bool cmDependsCompiler::CheckDependencies( std::vector depends; if (format == "custom"_s) { - auto deps = cmReadGccDepfile( + cm::optional deps = cmReadGccDepfile( depFile.c_str(), this->LocalGenerator->GetCurrentBinaryDirectory()); - if (!deps) { + if (!deps || deps->empty()) { continue; } @@ -130,10 +130,10 @@ bool cmDependsCompiler::CheckDependencies( depends.emplace_back(std::move(line)); } } else if (format == "gcc"_s) { - auto deps = cmReadGccDepfile( + cm::optional deps = cmReadGccDepfile( depFile.c_str(), this->LocalGenerator->GetCurrentBinaryDirectory(), GccDepfilePrependPaths::Deps); - if (!deps) { + if (!deps || deps->empty()) { continue; }