zeroc-ice 3.8.1 → 3.8.3

data/dist/ice/cpp/src/Slice/Parser.h

@@ -87,7 +87,6 @@ namespace Slice
 
     using StringList = std::list<std::string>;
     using MetadataList = std::list<MetadataPtr>;
-    using TypeList = std::list<TypePtr>;
     using ContainedList = std::list<ContainedPtr>;
     using ModuleList = std::list<ModulePtr>;
     using ClassList = std::list<ClassDefPtr>;
@@ -401,7 +400,7 @@ namespace Slice
         /// @remark Equivalent to `mappedScope(separator, leading) + mappedName()`.
         [[nodiscard]] std::string mappedScoped(const std::string& separator, bool leading = false) const;
 
-        /// Returns the mapped scope that this element will be generated in in the target language.
+        /// Returns the mapped scope in which this element will be generated in the target language.
         /// @param separator This string will be used to separate scope segments.
         /// @param leading If true, the returned string will have a leading `separator` (defaults to false).
         [[nodiscard]] std::string mappedScope(const std::string& separator, bool leading = false) const;
@@ -510,7 +509,7 @@ namespace Slice
         /// The user should disambiguate by qualifying the type-reference as 'Outer::H'.
         void checkHasChangedMeaning(const std::string& name, ContainedPtr namedThing = nullptr);
 
-        /// Returns `true` if this container is the global scope (i.e. it's of type `Unit`), and `false` otherwise.
+        /// Returns `false` if this container is the global scope (i.e. it's of type `Unit`), and `true` otherwise.
         /// If false, we emit an error message. So this function should only be called for types which cannot appear at
         /// global scope... so everything except for `Module`s.
         bool checkForGlobalDefinition(const char* definitionKindPlural);
@@ -692,8 +691,15 @@ namespace Slice
             Idempotent = 2
         };
 
-        Operation(const ContainerPtr&, const std::string&, TypePtr, bool, std::int32_t, Mode);
-        [[nodiscard]] InterfaceDefPtr interface() const;
+        Operation(
+            const ContainerPtr& container,
+            const std::string& name,
+            TypePtr returnType,
+            bool returnIsOptional,
+            std::int32_t returnTag,
+            Mode mode);
+
+        [[nodiscard]] InterfaceDefPtr parentInterface() const;
         [[nodiscard]] TypePtr returnType() const;
         [[nodiscard]] bool returnIsOptional() const;
         [[nodiscard]] std::int32_t returnTag() const;
@@ -726,7 +732,7 @@ namespace Slice
         [[nodiscard]] ParameterPtr returnParameter(const std::string& name);
 
         /// Returns this operation's out parameters and return type sorted in this order: '(required..., optional...)'.
-        /// If the this operation's return type is non-void and non-optional, it is at the end of the 'required' list.
+        /// If this operation's return type is non-void and non-optional, it is at the end of the 'required' list.
         /// Otherwise, required parameters are kept in definition order and optional parameters are sorted by tag.
         ///
         /// For convenience, non-void return types are represented by a dummy `Parameter` in this list.
@@ -740,12 +746,19 @@ namespace Slice
 
         [[nodiscard]] ExceptionList throws() const;
         void setExceptionList(const ExceptionList& exceptions);
+
+        /// Returns true if this operation uses class types in any of its in parameters.
         [[nodiscard]] bool sendsClasses() const;
+
+        /// Returns true if this operation uses class types in its return type, or any of its out parameters.
         [[nodiscard]] bool returnsClasses() const;
+
+        /// Returns true if this operation has any out parameters, a non-void return type, or can throw any exceptions.
         [[nodiscard]] bool returnsData() const;
 
         /// Returns true if this operation has any out parameters or a non-void return type.
         [[nodiscard]] bool returnsAnyValues() const;
+
         /// Returns true if this operation's output parameters, plus any non-void return type, is greater than 1.
         [[nodiscard]] bool returnsMultipleValues() const;
 
@@ -792,6 +805,7 @@ namespace Slice
         [[nodiscard]] InterfaceList allBases() const;
         [[nodiscard]] OperationList operations() const;
         [[nodiscard]] OperationList allOperations() const;
+        [[nodiscard]] OperationList allInheritedOperations() const;
         [[nodiscard]] std::string kindOf() const final;
         void visit(ParserVisitor* visitor) final;
 
@@ -1019,7 +1033,7 @@ namespace Slice
         [[nodiscard]] TypePtr type() const;
         [[nodiscard]] bool isOutParam() const;
         void setIsOutParam();
-        [[nodiscard]] bool optional() const;
+        [[nodiscard]] bool isOptional() const;
         [[nodiscard]] std::int32_t tag() const;
         [[nodiscard]] std::string kindOf() const final;
 
@@ -1048,7 +1062,7 @@ namespace Slice
             SyntaxTreeBasePtr defaultValueType,
             std::optional<std::string> defaultValueString);
         [[nodiscard]] TypePtr type() const;
-        [[nodiscard]] bool optional() const;
+        [[nodiscard]] bool isOptional() const;
         [[nodiscard]] std::int32_t tag() const;
 
         // defaultValue() and defaultValueType() are either both null (no default value) or both non-null.

data/dist/ice/cpp/src/Slice/Preprocessor.cpp

@@ -9,21 +9,80 @@
 #include "Util.h"
 #include <algorithm>
 #include <cassert>
+#include <cerrno>
 #include <cstring>
+#include <fcntl.h>
 #include <fstream>
 #include <iterator>
 #include <sys/stat.h>
 #include <sys/types.h>
 #include <vector>
 
-#ifndef _WIN32
+#ifdef _WIN32
+#    include <io.h>
+#    include <share.h>
+#else
 #    include <sys/wait.h>
+#    include <unistd.h>
 #endif
 
 using namespace std;
 using namespace Slice;
 using namespace IceInternal;
 
+namespace
+{
+    // Atomically create and open a new file for read/write, failing if the file already exists or, on POSIX, if the
+    // path resolves to a symlink. This avoids the TOCTOU race that a name-then-open sequence would otherwise expose
+    // to a local attacker who could plant a symlink at the generated path.
+#ifdef _WIN32
+    FILE* openExclusive(const wchar_t* path)
+    {
+        int fd = -1;
+        // _O_TEMPORARY tells the CRT to delete the file when the last file descriptor is closed -- this avoids the
+        // need for a separate, racy unlink-by-name in close().
+        if (::_wsopen_s(
+                &fd,
+                path,
+                _O_RDWR | _O_CREAT | _O_EXCL | _O_BINARY | _O_TEMPORARY,
+                _SH_DENYRW,
+                _S_IREAD | _S_IWRITE) != 0)
+        {
+            return nullptr;
+        }
+        FILE* fp = ::_fdopen(fd, "w+");
+        if (!fp)
+        {
+            ::_close(fd);
+        }
+        return fp;
+    }
+#else
+    FILE* openExclusive(const char* path)
+    {
+        int fd = ::open(path, O_RDWR | O_CREAT | O_EXCL | O_NOFOLLOW, S_IRUSR | S_IWUSR);
+        if (fd == -1)
+        {
+            return nullptr;
+        }
+        // Unlink immediately so the file is anonymous: the inode survives via our descriptor and the kernel
+        // releases it on close. ENOENT means another process already removed the entry, leaving us in the same
+        // state; any other unlink error is fatal because the caller has no path to retry cleanup.
+        if (::unlink(path) != 0 && errno != ENOENT)
+        {
+            ::close(fd);
+            return nullptr;
+        }
+        FILE* fp = ::fdopen(fd, "w+");
+        if (!fp)
+        {
+            ::close(fd);
+        }
+        return fp;
+    }
+#endif
+}
+
 //
 // mcpp defines
 //
@@ -51,24 +110,16 @@ Slice::Preprocessor::create(const string& path, const string& fileName, const ve
 Slice::Preprocessor::Preprocessor(string path, const string& fileName, const vector<string>& args)
     : _path(std::move(path)),
       _fileName(fullPath(fileName)),
-      _shortFileName(fileName),
       _args(args)
 {
 }
 
 Slice::Preprocessor::~Preprocessor() { close(); }
 
-string
-Slice::Preprocessor::getFileName()
-{
-    return _fileName;
-}
-
 string
 Slice::Preprocessor::getBaseName()
 {
     string base(_fileName);
-    string suffix;
     string::size_type pos = base.rfind('.');
     if (pos != string::npos)
     {
@@ -197,36 +248,36 @@ Slice::Preprocessor::preprocess(const string& languageArg)
         char* buf = mcpp_get_mem_buffer(Out);
 
         //
-        // First try to open temporay file in tmp directory.
+        // First try to open a temporary file in the 'tmp' directory.
         //
 #ifdef _WIN32
         //
-        // We use an unique id as the tmp file name prefix to avoid
-        // problems with this code being called concurrently from
-        // several processes, otherwise there is a change that two
-        // process call _tempnam before any of them call fopen and
-        // they will end up using the same tmp file.
+        // We use a unique id as the tmp file name prefix to avoid problems with this code being called concurrently
+        // from several processes, otherwise there is a chance that two processes call _wtempnam before any of them
+        // opens the file and they will end up using the same tmp file. We then open the file with O_EXCL to atomically
+        // create it -- this closes the TOCTOU window between _wtempnam returning a name and our opening it. The
+        // _O_TEMPORARY flag inside openExclusive causes the file to be deleted automatically when the descriptor is
+        // closed, so we don't need to retain the path past this point.
         //
         wchar_t* name = _wtempnam(0, Ice::stringToWstring("slice-" + Ice::generateUUID()).c_str());
         if (name)
         {
-            _cppFile = Ice::wstringToString(name);
+            _cppHandle = openExclusive(name);
             free(name);
-            _cppHandle = IceInternal::fopen(_cppFile, "w+");
         }
 #else
         _cppHandle = tmpfile();
 #endif
 
-        // If that fails try to open file in current directory.
+        // If that fails try to open file in current directory. openExclusive immediately unlinks the file on POSIX
+        // and sets _O_TEMPORARY on Windows, so the path is only used during the open attempt.
         if (_cppHandle == nullptr)
         {
 #ifdef _WIN32
-            _cppFile = "slice-" + Ice::generateUUID();
+            _cppHandle = openExclusive(Ice::stringToWstring("slice-" + Ice::generateUUID()).c_str());
 #else
-            _cppFile = ".slice-" + Ice::generateUUID();
+            _cppHandle = openExclusive((".slice-" + Ice::generateUUID()).c_str());
 #endif
-            _cppHandle = IceInternal::fopen(_cppFile, "w+");
         }
 
         if (_cppHandle != nullptr)
@@ -241,7 +292,7 @@ Slice::Preprocessor::preprocess(const string& languageArg)
         {
             // Calling this again causes the memory buffers to be freed.
             mcpp_use_mem_buffers(1);
-            throw runtime_error(_path + ": error: could not open temporary file: " + _cppFile);
+            throw runtime_error(_path + ": error: could not open temporary file for preprocessor output");
         }
     }
 
@@ -256,14 +307,11 @@ Slice::Preprocessor::close()
 {
     if (_cppHandle != nullptr)
     {
+        // The temp file deletes itself when the descriptor is closed. On POSIX, tmpfile() returns an
+        // already-unlinked file and the CWD fallback unlinks after open; on Windows, openExclusive opens
+        // with _O_TEMPORARY. fclose is the only cleanup needed.
         int status = fclose(_cppHandle);
         _cppHandle = nullptr;
-
-        if (_cppFile.size() != 0)
-        {
-            IceInternal::unlink(_cppFile);
-        }
-
         if (status != 0)
         {
             throw runtime_error("failed to close preprocessor file: " + IceInternal::lastErrorToString());
@@ -283,7 +331,7 @@ Slice::Preprocessor::checkInputFile()
     }
     if (suffix != ".ice")
     {
-        throw runtime_error(_path + ": error: input files must end with `.ice'");
+        throw runtime_error(_path + ": error: input files must end with '.ice'");
     }
 
     ifstream test(IceInternal::streamFilename(_fileName).c_str());

data/dist/ice/cpp/src/Slice/Preprocessor.h

@@ -24,7 +24,6 @@ namespace Slice
         FILE* preprocess(const std::string& languageArg = "");
         void close();
 
-        std::string getFileName();
         std::string getBaseName();
 
         static std::string normalizeIncludePath(const std::string& path);
@@ -34,9 +33,7 @@ namespace Slice
 
         const std::string _path;
         const std::string _fileName;
-        const std::string _shortFileName;
         const std::vector<std::string> _args;
-        std::string _cppFile;
         FILE* _cppHandle{nullptr};
     };
 }

data/dist/ice/cpp/src/Slice/Scanner.cpp

@@ -1829,7 +1829,7 @@ YY_RULE_SETUP
 }
 	YY_BREAK
 /* Matches the end of a double-quoted string literal, but only while scanning a string literal. Flex always prefers
-   * to match the longest string it can, so quotes preceeded with a literal '\' will match the rules above this one. */
+   * to match the longest string it can, so quotes preceded with a literal '\' will match the rules above this one. */
 case 18:
 YY_RULE_SETUP
 #line 261 "src/Slice/Scanner.l"
@@ -2233,7 +2233,7 @@ YY_RULE_SETUP
     return BAD_TOKEN;
 }
 	YY_BREAK
-/* Matches any valid character (except newlines) not matched by another rule and fowards it to the parser.
+/* Matches any valid character (except newlines) not matched by another rule and forwards it to the parser.
    * This is the lowest priority rule in the scanner, and is only active while not in a sub-scanner. */
 case 50:
 YY_RULE_SETUP
@@ -3390,7 +3390,7 @@ namespace
         keywordMap["Value"] = ICE_VALUE;
     }
 
-    // This function is always called directly after a match has been made, but directly before it's action block is run.
+    // This function is always called directly after a match has been made, but directly before its action block is run.
     void preAction()
     {
         yycolno += yyleng;