diff mbox

Prevent out-of-bounds access (PR sanitizer/59258)

Message ID 20131125092700.GK30062@redhat.com
State New
Headers show

Commit Message

Marek Polacek Nov. 25, 2013, 9:27 a.m. UTC
This fixes a thinko of mine: when I added another two elements to the
ubsan data structure, I forgot to increase the size of the array.

Alternatively, I could use an alloca for this (VLAs issue a warning
in C++03 and are thus no-go :().

I don't have a simple testcase for this.  Valgrind/asan would be
needed.

Ran the testsuite.  Ok for trunk?

2013-11-25  Marek Polacek  <polacek@redhat.com>

	* ubsan.c (ubsan_create_data): Increase the size of the fields array.


	Marek

Comments

Jakub Jelinek Nov. 25, 2013, 9:36 a.m. UTC | #1
On Mon, Nov 25, 2013 at 10:27:00AM +0100, Marek Polacek wrote:
> This fixes a thinko of mine: when I added another two elements to the
> ubsan data structure, I forgot to increase the size of the array.
> 
> Alternatively, I could use an alloca for this (VLAs issue a warning
> in C++03 and are thus no-go :().
> 
> I don't have a simple testcase for this.  Valgrind/asan would be
> needed.
> 
> Ran the testsuite.  Ok for trunk?
> 
> 2013-11-25  Marek Polacek  <polacek@redhat.com>
> 
> 	* ubsan.c (ubsan_create_data): Increase the size of the fields array.

Ok, but can you also fix up formatting in the function:

      /* We have to add two more decls.  */
      fields[i] = build_decl (UNKNOWN_LOCATION, FIELD_DECL, NULL_TREE,
                                pointer_sized_int_node);
the above line is indented too much... .

> --- gcc/ubsan.c.mp3	2013-11-25 10:13:41.995328200 +0100
> +++ gcc/ubsan.c	2013-11-25 10:19:10.068560008 +0100
> @@ -387,7 +387,7 @@ ubsan_create_data (const char *name, loc
>  {
>    va_list args;
>    tree ret, t;
> -  tree fields[3];
> +  tree fields[5];
>    vec<tree, va_gc> *saved_args = NULL;
>    size_t i = 0;
>  

	Jakub
diff mbox

Patch

--- gcc/ubsan.c.mp3	2013-11-25 10:13:41.995328200 +0100
+++ gcc/ubsan.c	2013-11-25 10:19:10.068560008 +0100
@@ -387,7 +387,7 @@  ubsan_create_data (const char *name, loc
 {
   va_list args;
   tree ret, t;
-  tree fields[3];
+  tree fields[5];
   vec<tree, va_gc> *saved_args = NULL;
   size_t i = 0;