Fix potential segfault with stream iterators.

hilti/runtime/include/types/stream.h

@@ -717,13 +717,22 @@ class SafeConstIterator {
         if ( ! n )
             return;
 
-        _offset += n;
+        if ( _chain->isValid() ) {
+            const Chunk* hint = nullptr;
+
+            if ( _chain->inRange(_offset) )
+                hint = _chunk; // current chunk is still valid
+            else
+                hint = _chain->head(); // previous chunk was likely trimmed off, try new head
 
-        if ( ! (_chain && _chain->isValid()) )
-            return; // will be caught when dereferenced
+            _chunk = _chain->findChunk(_offset + n, hint); // null if we're pointing beyond the end now
+        }
+        else
+            // Invalid chain will trigger exception when dereferenced, but
+            // invalidate chunk to be safe.
+            _chunk = nullptr;
 
-        _chunk = _chain->findChunk(_offset, chunk());
-        // chunk will be null if we're pointing beyond the end.
+        _offset += n;
     }
 
     void _decrement(const integer::safe<uint64_t>& n) {
@@ -736,16 +745,28 @@ class SafeConstIterator {
         if ( ! n )
             return;
 
-        _offset -= n;
+        if ( _chain->isValid() ) {
+            const Chunk* hint = nullptr;
 
-        if ( _chunk && _offset > _chunk->offset() )
-            return; // fast-path, chunk still valid
+            if ( _chain->inRange(_offset) ) {
+                if ( _chunk && _chunk->inRange(_offset - n) ) {
+                    _offset -= n;
+                    return; // fast-path, inside still-valid chunk
+                }
 
-        if ( ! (_chain && _chain->isValid()) )
-            return; // will be caught when dereferenced
+                hint = _chunk; // current chunk is still valid
+            }
+            else
+                hint = _chain->head(); // previous chunk was likely trimmed off, try new head
 
-        _chunk = _chain->findChunk(_offset, _chunk);
-        // chunk will be null if we're pointing beyond the beginning.
+            _chunk = _chain->findChunk(_offset - n, hint); // null if we're pointing outside the chain now
+        }
+        else
+            // Invalid chain will trigger exception when dereferenced, but
+            // invalidate chunk to be safe.
+            _chunk = nullptr;
+
+        _offset -= n;
     }
 
     Byte _dereference() const {

hilti/runtime/src/tests/stream.cc

@@ -486,6 +486,20 @@ TEST_CASE("iteration") {
         CHECK_EQ(*it, '3');
     }
 
+    SUBCASE("increment - regression test for #1918") {
+        auto s = make_stream({"123"_b});
+        // Add two more chunks, with the 1st larger than the existing one. This
+        // will let the trim later destroy the original chunk, instead of
+        // continuing to cache it internally.
+        s.append("4567"_b);
+        s.append("890"_b);
+
+        auto i = s.begin();
+        s.trim(i + 4);
+        s.trim(i + 7);
+        i = i + 7; // triggered ASAN heap-use-after-free before fixing #1918
+    }
+
     SUBCASE("decrement - SafeIterator") {
         // This test is value-parameterized over `s`.
         Stream s;
@@ -512,6 +526,20 @@ TEST_CASE("iteration") {
         CHECK_THROWS_AS((it -= 100), const InvalidIterator&);
     }
 
+    SUBCASE("decrement - regression test for #1918") {
+        auto s = make_stream({"123"_b});
+        // Add two more chunks, with the 1st smaller than the existing one.
+        // This will let the trim later destroy this added chunk, instead of
+        // continuing to cache it internally.
+        s.append("45"_b);
+        s.append("678"_b);
+
+        auto i = s.begin() + 4;
+        s.trim(i);
+        s.trim(i + 3);
+        i = i - 4; // triggered ASAN heap-use-after-free before fixing #1918
+    }
+
     SUBCASE("decrement - UnsafeIterator") {
         // This test is value-parameterized over `s`.
         Stream s;