mirror/gcc
2
0
Fork 0
mirror of git://gcc.gnu.org/git/gcc.git synced 2025-04-08 15:42:07 +08:00
Code Issues Packages Projects Releases Wiki Activity

fold-const: Fix up a buffer overflow in native_encode_initializer [PR98407]

Browse Source 
For flexible array members we need to incrementally clear just from
ptr + total_bytes up to new ptr + total_bytes, but memset has been called
with the length from ptr, so was missing - total_bytes.  Additionally,
in this code off is guaranteed to be -1 and thus o 0, so don't bother pretending
we could handle anything else, it would be more complicated than that.

2020-12-21  Jakub Jelinek  <jakub@redhat.com>

	PR tree-optimization/98407
	* fold-const.c (native_encode_initializer): When handling flexible
	array members, fix up computation of length for memset.  Also remove
	" - o" as o is always guaranteed to be 0 in this code path.

	* gcc.c-torture/compile/pr98407.c: New test.
This commit is contained in:
Jakub Jelinek 2020-12-21 10:14:46 +01:00
parent b6237343e7
commit d8aeee11af
2 changed files with 13 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
gcc/fold-const.c
View File

@ -8280,9 +8280,9 @@ native_encode_initializer (tree init, unsigned char *ptr, int len,
return 0;
if (pos + fieldsize > total_bytes)
{
if (ptr != NULL && total_bytes - o < len)
memset (ptr + (total_bytes - o),
'\0', MIN (pos + fieldsize - o, len));
if (ptr != NULL && total_bytes < len)
memset (ptr + total_bytes, '\0',
MIN (pos + fieldsize, len) - total_bytes);
total_bytes = pos + fieldsize;
}
}

10
gcc/testsuite/gcc.c-torture/compile/pr98407.c Normal file
View File

@ -0,0 +1,10 @@
/* PR tree-optimization/98407 */
struct S { int a; int b[]; };
const struct S c = { 0, { 0 } }, d = { 0, { 0 } };
int
foo (void)
{
return __builtin_memcmp (&c, &d, sizeof d);
}