mirror of
https://gitlab.kitware.com/cmake/cmake.git
synced 2026-09-25 04:09:36 +03:00
Mickaël Germain
3151f7824f
The TRANSFORM action registry held one live action instance per action for the whole process, and each instance carried per-call state: a raw Selector pointer, REPLACE's helper, APPEND/PREPEND's operands. That was harmless while every action ran to completion uninterrupted, but commitc7af6e94d8(list(TRANSFORM): Add PREDICATE selector, 2026-04-08, v4.4.0-rc1) added a selector that runs a user function once per element, interleaved with the transform. User code reentering list(TRANSFORM) with the same action now rebinds the shared instance mid-flight. That produces silently wrong results, and a use-after-free once any element is transformed after the reentering one. It needs no unusual code to hit: a predicate calling find_package(Python) reaches list(TRANSFORM ... REPLACE) inside FindPython's own module. Make action objects immutable and per-call. Operands and the selector become constructor arguments, Initialize is deleted, and the registry becomes a constexpr table of metadata with a MakeTransformAction factory. The InSelection guard, duplicated in all eight actions, moves into the base class. This also closes a second hole in the same machinery. TransformActionApply overrode only the vector form of Initialize, so transform(APPLY, "f", selector) dispatched to the empty two-argument virtual in the base, left Selector null, and dereferenced it. With no virtual Initialize left to inherit, an APPLY action without a cmMakefile is no longer constructible, so the throwing stub that guarded the vector form is no longer needed. Close a third, from commit651f82642c(Add APPLY action for list(TRANSFORM), 2026-04-08, v4.4.0-rc1): the cmMakefile overload performs APPLY unconditionally but validated only the arity of the action passed to it. APPEND, PREPEND and APPLY all take one argument, so transform(APPEND, "x", makefile) passed validation and then silently ran APPLY, calling "x" as a function instead of appending it. Reject any action but APPLY up front. That path is unreachable from CMake code, since HandleTransformCommand only selects the overload for APPLY, and Tests/CMakeLib has no cmMakefile to drive it with, so it carries no test. Document the predicate's evaluation order while here. It runs once per element, immediately before that element would be transformed. The manual did not state the timing, which matters precisely because a predicate that reenters list(TRANSFORM) observes the outer call mid-flight. Fixes: #28031