fix #13879: crash when loading invalid compile_commands.json file (danmar#7548)

Author: ludviggunne

lib/importproject.cpp

@@ -359,6 +359,17 @@ bool ImportProject::importCompileCommands(std::istream &istr)
 
     for (const picojson::value &fileInfo : compileCommands.get<picojson::array>()) {
         picojson::object obj = fileInfo.get<picojson::object>();
+
+        if (obj.count("directory") == 0) {
+            printError("'directory' field in compilation database entry missing");
+            return false;
+        }
+
+        if (!obj["directory"].is<std::string>()) {
+            printError("'directory' field in compilation database entry is not a string");
+            return false;
+        }
+
         std::string dirpath = Path::fromNativeSeparators(obj["directory"].get<std::string>());
 
         /* CMAKE produces the directory without trailing / so add it if not

test/testimportproject.cpp

@@ -67,6 +67,8 @@ class TestImportProject : public TestFixture {
         TEST_CASE(importCompileCommands13); // #13333: duplicate file entries
         TEST_CASE(importCompileCommandsArgumentsSection); // Handle arguments section
         TEST_CASE(importCompileCommandsNoCommandSection); // gracefully handles malformed json
+        TEST_CASE(importCompileCommandsDirectoryMissing); // 'directory' field missing
+        TEST_CASE(importCompileCommandsDirectoryInvalid); // 'directory' field not a string
         TEST_CASE(importCppcheckGuiProject);
         TEST_CASE(ignorePaths);
     }
@@ -384,6 +386,27 @@ class TestImportProject : public TestFixture {
         ASSERT_EQUALS("cppcheck: error: no 'arguments' or 'command' field found in compilation database entry\n", GET_REDIRECT_OUTPUT);
     }
 
+    void importCompileCommandsDirectoryMissing() const {
+        REDIRECT;
+        constexpr char json[] = "[ { \"file\": \"src.mm\" } ]";
+        std::istringstream istr(json);
+        TestImporter importer;
+        ASSERT_EQUALS(false, importer.importCompileCommands(istr));
+        ASSERT_EQUALS(0, importer.fileSettings.size());
+        ASSERT_EQUALS("cppcheck: error: 'directory' field in compilation database entry missing\n", GET_REDIRECT_OUTPUT);
+    }
+
+    void importCompileCommandsDirectoryInvalid() const {
+        REDIRECT;
+        constexpr char json[] = "[ { \"directory\": 123,"
+                                "\"file\": \"src.mm\" } ]";
+        std::istringstream istr(json);
+        TestImporter importer;
+        ASSERT_EQUALS(false, importer.importCompileCommands(istr));
+        ASSERT_EQUALS(0, importer.fileSettings.size());
+        ASSERT_EQUALS("cppcheck: error: 'directory' field in compilation database entry is not a string\n", GET_REDIRECT_OUTPUT);
+    }
+
     void importCppcheckGuiProject() const {
         REDIRECT;
         constexpr char xml[] = "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n"