Message ID | 5bcb69810185bfa4d614aef0c57fb4641b1ae2eb.camel@gmail.com |
---|---|
State | New |
Headers | show |
Series | gcc/jit/jit-recording.cc: recording::global::write_to_dump: Avoid crashes when writing psuedo-C for globals with string initializers. | expand |
On Fri, 2022-11-25 at 02:13 +0530, Vibhav Pant via Jit wrote: > If a char * global was initialized with a rvalue from > `gcc_jit_context_new_string_literal` containing a format string, > dumping the context causes libgccjit to SIGSEGV due to an improperly > constructed call to vasprintf. The following code snippet can > reproduce > the crash: > > int main(int argc, char **argv) > { > gcc_jit_context *ctxt = gcc_jit_context_acquire (); > gcc_jit_lvalue *var = gcc_jit_context_new_global( > ctxt, NULL, GCC_JIT_GLOBAL_EXPORTED, > gcc_jit_context_get_type(ctxt, GCC_JIT_TYPE_CONST_CHAR_PTR), > "var"); > gcc_jit_global_set_initializer_rvalue( > var, gcc_jit_context_new_string_literal(ctxt, "%s")); > gcc_jit_context_dump_to_file (ctxt, "output", 0); > return 0; > } > > The offending line is jit-recording.cc:4922, where a call to d.write > passes the initializer rvalue's debug string to `write` without a > format specifier. The attached patch fixes this issue. Thanks for spotting this, and sorry about missing your patch. I've gone ahead and pushed this to trunk (as r14-4923-gac66744d94226a), and will backport it. Dave
From e598a4076b2bff72b4a3cc29d1d70db8c53baf45 Mon Sep 17 00:00:00 2001 From: Vibhav Pant <vibhavp@gmail.com> Date: Fri, 25 Nov 2022 02:02:09 +0530 Subject: [PATCH] jit-recording.cc: Dump string literal initializers correctly --- gcc/jit/jit-recording.cc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gcc/jit/jit-recording.cc b/gcc/jit/jit-recording.cc index 6ae5a667e90..7bb98ddcb42 100644 --- a/gcc/jit/jit-recording.cc +++ b/gcc/jit/jit-recording.cc @@ -4919,7 +4919,7 @@ recording::global::write_to_dump (dump &d) else if (m_rvalue_init) { d.write (" = "); - d.write (m_rvalue_init->get_debug_string ()); + d.write ("%s", m_rvalue_init->get_debug_string ()); d.write (";\n"); } -- 2.38.1