authorgravatar for kris.tate+github@gmail.comkristopher tate <kris.tate+github@gmail.com> 2018-08-27 01:22:50+09:00
committergravatar for andrew@ziglang.orgAndrew Kelley <andrew@ziglang.org> 2018-08-26 13:02:09-04:00
log0839ed1f945dbbe3ad1f780a5334ad16ad12fd5e
tree0c5e1bf991b7183f443038be1be7db36c17bbe84
parent8047f0eae2da64a88474dbe9106c61b3e26e6871

src/ir.cpp: check return value of `const_ptr_pointee` to protect against dereferencing null pointers;

1 files changed, 21 insertions(+), 1 deletions(-)

src/ir.cpp+21-1
......@@ -10982,6 +10982,7 @@ static IrInstruction *ir_get_deref(IrAnalyze *ira, IrInstruction *source_instruc
1098210982 ptr->value.data.x_ptr.mut == ConstPtrMutComptimeVar)
1098310983 {
1098410984 ConstExprValue *pointee = const_ptr_pointee(ira->codegen, &ptr->value);
10985 if (!pointee) return ira->codegen->invalid_instruction;
1098510986 if (pointee->special != ConstValSpecialRuntime) {
1098610987 IrInstruction *result = ir_create_const(&ira->new_irb, source_instruction->scope,
1098710988 source_instruction->source_node, child_type);
......@@ -13655,6 +13656,7 @@ static TypeTableEntry *ir_analyze_dereference(IrAnalyze *ira, IrInstructionUnOp
1365513656 return ira->codegen->builtin_types.entry_invalid;
1365613657
1365713658 ConstExprValue *pointee = const_ptr_pointee(ira->codegen, comptime_value);
13659 if (!pointee) return ira->codegen->builtin_types.entry_invalid;
1365813660 if (pointee->type == child_type) {
1365913661 ConstExprValue *out_val = ir_build_const_from(ira, &un_op_instruction->base);
1366013662 copy_const_val(out_val, pointee, value->value.data.x_ptr.mut == ConstPtrMutComptimeConst);
......@@ -14058,6 +14060,7 @@ static TypeTableEntry *ir_analyze_instruction_elem_ptr(IrAnalyze *ira, IrInstruc
1405814060 ptr_type = ptr_type->data.pointer.child_type;
1405914061 if (orig_array_ptr_val->special != ConstValSpecialRuntime) {
1406014062 orig_array_ptr_val = const_ptr_pointee(ira->codegen, orig_array_ptr_val);
14063 if (!orig_array_ptr_val) return ira->codegen->builtin_types.entry_invalid;
1406114064 }
1406214065 }
1406314066 if (array_type->data.array.len == 0) {
......@@ -14099,6 +14102,7 @@ static TypeTableEntry *ir_analyze_instruction_elem_ptr(IrAnalyze *ira, IrInstruc
1409914102 if (!ptr_val)
1410014103 return ira->codegen->builtin_types.entry_invalid;
1410114104 ConstExprValue *args_val = const_ptr_pointee(ira->codegen, ptr_val);
14105 if (!args_val) return ira->codegen->builtin_types.entry_invalid;
1410214106 size_t start = args_val->data.x_arg_tuple.start_index;
1410314107 size_t end = args_val->data.x_arg_tuple.end_index;
1410414108 uint64_t elem_index_val;
......@@ -14380,6 +14384,7 @@ static IrInstruction *ir_analyze_container_field_ptr(IrAnalyze *ira, Buf *field_
1438014384
1438114385 if (ptr_val->data.x_ptr.special != ConstPtrSpecialHardCodedAddr) {
1438214386 ConstExprValue *struct_val = const_ptr_pointee(ira->codegen, ptr_val);
14387 if (!struct_val) return ira->codegen->invalid_instruction;
1438314388 if (type_is_invalid(struct_val->type))
1438414389 return ira->codegen->invalid_instruction;
1438514390 ConstExprValue *field_val = &struct_val->data.x_struct.fields[field->src_index];
......@@ -14422,6 +14427,7 @@ static IrInstruction *ir_analyze_container_field_ptr(IrAnalyze *ira, Buf *field_
1442214427
1442314428 if (ptr_val->data.x_ptr.special != ConstPtrSpecialHardCodedAddr) {
1442414429 ConstExprValue *union_val = const_ptr_pointee(ira->codegen, ptr_val);
14430 if (!union_val) return ira->codegen->invalid_instruction;
1442514431 if (type_is_invalid(union_val->type))
1442614432 return ira->codegen->invalid_instruction;
1442714433
......@@ -14618,6 +14624,7 @@ static TypeTableEntry *ir_analyze_instruction_field_ptr(IrAnalyze *ira, IrInstru
1461814624
1461914625 assert(container_ptr->value.type->id == TypeTableEntryIdPointer);
1462014626 ConstExprValue *child_val = const_ptr_pointee(ira->codegen, container_ptr_val);
14627 if (!child_val) return ira->codegen->builtin_types.entry_invalid;
1462114628
1462214629 if (buf_eql_str(field_name, "len")) {
1462314630 ConstExprValue *len_val = create_const_vals(1);
......@@ -14642,6 +14649,7 @@ static TypeTableEntry *ir_analyze_instruction_field_ptr(IrAnalyze *ira, IrInstru
1464214649
1464314650 assert(container_ptr->value.type->id == TypeTableEntryIdPointer);
1464414651 ConstExprValue *child_val = const_ptr_pointee(ira->codegen, container_ptr_val);
14652 if (!child_val) return ira->codegen->builtin_types.entry_invalid;
1464514653 TypeTableEntry *child_type = child_val->data.x_type;
1464614654
1464714655 if (type_is_invalid(child_type)) {
......@@ -14910,6 +14918,7 @@ static TypeTableEntry *ir_analyze_instruction_field_ptr(IrAnalyze *ira, IrInstru
1491014918 return ira->codegen->builtin_types.entry_invalid;
1491114919
1491214920 ConstExprValue *namespace_val = const_ptr_pointee(ira->codegen, container_ptr_val);
14921 if (!namespace_val) return ira->codegen->builtin_types.entry_invalid;
1491314922 assert(namespace_val->special == ConstValSpecialStatic);
1491414923
1491514924 ImportTableEntry *namespace_import = namespace_val->data.x_import;
......@@ -14986,6 +14995,7 @@ static TypeTableEntry *ir_analyze_instruction_store_ptr(IrAnalyze *ira, IrInstru
1498614995 if (ptr->value.data.x_ptr.mut == ConstPtrMutComptimeVar) {
1498714996 if (instr_is_comptime(casted_value)) {
1498814997 ConstExprValue *dest_val = const_ptr_pointee(ira->codegen, &ptr->value);
14998 if (!dest_val) return ira->codegen->builtin_types.entry_invalid;
1498914999 if (dest_val->special != ConstValSpecialRuntime) {
1499015000 *dest_val = casted_value->value;
1499115001 if (!ira->new_irb.current_basic_block->must_be_comptime_source_instr) {
......@@ -14997,6 +15007,7 @@ static TypeTableEntry *ir_analyze_instruction_store_ptr(IrAnalyze *ira, IrInstru
1499715007 ir_add_error(ira, &store_ptr_instruction->base,
1499815008 buf_sprintf("cannot store runtime value in compile time variable"));
1499915009 ConstExprValue *dest_val = const_ptr_pointee(ira->codegen, &ptr->value);
15010 if (!dest_val) return ira->codegen->builtin_types.entry_invalid;
1500015011 dest_val->type = ira->codegen->builtin_types.entry_invalid;
1500115012
1500215013 return ira->codegen->builtin_types.entry_invalid;
......@@ -15850,7 +15861,7 @@ static TypeTableEntry *ir_analyze_instruction_switch_target(IrAnalyze *ira,
1585015861 ConstExprValue *pointee_val = nullptr;
1585115862 if (instr_is_comptime(target_value_ptr)) {
1585215863 pointee_val = const_ptr_pointee(ira->codegen, &target_value_ptr->value);
15853 if (pointee_val->special == ConstValSpecialRuntime)
15864 if (pointee_val && pointee_val->special == ConstValSpecialRuntime)
1585415865 pointee_val = nullptr;
1585515866 }
1585615867 if ((err = ensure_complete_type(ira->codegen, target_type)))
......@@ -15981,6 +15992,7 @@ static TypeTableEntry *ir_analyze_instruction_switch_var(IrAnalyze *ira, IrInstr
1598115992 return ira->codegen->builtin_types.entry_invalid;
1598215993
1598315994 ConstExprValue *pointee_val = const_ptr_pointee(ira->codegen, target_val_ptr);
15995 if (!pointee_val) return ira->codegen->builtin_types.entry_invalid;
1598415996 ConstExprValue *out_val = ir_build_const_from(ira, &instruction->base);
1598515997 out_val->data.x_ptr.special = ConstPtrSpecialRef;
1598615998 out_val->data.x_ptr.mut = target_val_ptr->data.x_ptr.mut;
......@@ -18732,11 +18744,14 @@ static TypeTableEntry *ir_analyze_instruction_slice(IrAnalyze *ira, IrInstructio
1873218744 TypeTableEntry *child_array_type = array_type->data.pointer.child_type;
1873318745 assert(child_array_type->id == TypeTableEntryIdArray);
1873418746 parent_ptr = const_ptr_pointee(ira->codegen, &ptr_ptr->value);
18747 if (!parent_ptr) return ira->codegen->builtin_types.entry_invalid;
1873518748 array_val = const_ptr_pointee(ira->codegen, parent_ptr);
18749 if (!array_val) return ira->codegen->builtin_types.entry_invalid;
1873618750 rel_end = child_array_type->data.array.len;
1873718751 abs_offset = 0;
1873818752 } else {
1873918753 array_val = const_ptr_pointee(ira->codegen, &ptr_ptr->value);
18754 if (!array_val) return ira->codegen->builtin_types.entry_invalid;
1874018755 rel_end = array_type->data.array.len;
1874118756 parent_ptr = nullptr;
1874218757 abs_offset = 0;
......@@ -18744,6 +18759,7 @@ static TypeTableEntry *ir_analyze_instruction_slice(IrAnalyze *ira, IrInstructio
1874418759 } else if (array_type->id == TypeTableEntryIdPointer) {
1874518760 assert(array_type->data.pointer.ptr_len == PtrLenUnknown);
1874618761 parent_ptr = const_ptr_pointee(ira->codegen, &ptr_ptr->value);
18762 if (!parent_ptr) return ira->codegen->builtin_types.entry_invalid;
1874718763 if (parent_ptr->special == ConstValSpecialUndef) {
1874818764 array_val = nullptr;
1874918765 abs_offset = 0;
......@@ -18775,6 +18791,7 @@ static TypeTableEntry *ir_analyze_instruction_slice(IrAnalyze *ira, IrInstructio
1877518791 }
1877618792 } else if (is_slice(array_type)) {
1877718793 ConstExprValue *slice_ptr = const_ptr_pointee(ira->codegen, &ptr_ptr->value);
18794 if (!slice_ptr) return ira->codegen->builtin_types.entry_invalid;
1877818795 parent_ptr = &slice_ptr->data.x_struct.fields[slice_ptr_index];
1877918796 ConstExprValue *len_val = &slice_ptr->data.x_struct.fields[slice_len_index];
1878018797
......@@ -19175,6 +19192,7 @@ static TypeTableEntry *ir_analyze_instruction_overflow_op(IrAnalyze *ira, IrInst
1917519192 BigInt *op1_bigint = &casted_op1->value.data.x_bigint;
1917619193 BigInt *op2_bigint = &casted_op2->value.data.x_bigint;
1917719194 ConstExprValue *pointee_val = const_ptr_pointee(ira->codegen, &casted_result_ptr->value);
19195 if (!pointee_val) return ira->codegen->builtin_types.entry_invalid;
1917819196 BigInt *dest_bigint = &pointee_val->data.x_bigint;
1917919197 switch (instruction->op) {
1918019198 case IrOverflowOpAdd:
......@@ -19275,6 +19293,7 @@ static TypeTableEntry *ir_analyze_instruction_unwrap_err_code(IrAnalyze *ira,
1927519293 if (!ptr_val)
1927619294 return ira->codegen->builtin_types.entry_invalid;
1927719295 ConstExprValue *err_union_val = const_ptr_pointee(ira->codegen, ptr_val);
19296 if (!err_union_val) return ira->codegen->builtin_types.entry_invalid;
1927819297 if (err_union_val->special != ConstValSpecialRuntime) {
1927919298 ErrorTableEntry *err = err_union_val->data.x_err_union.err;
1928019299 assert(err);
......@@ -19323,6 +19342,7 @@ static TypeTableEntry *ir_analyze_instruction_unwrap_err_payload(IrAnalyze *ira,
1932319342 if (!ptr_val)
1932419343 return ira->codegen->builtin_types.entry_invalid;
1932519344 ConstExprValue *err_union_val = const_ptr_pointee(ira->codegen, ptr_val);
19345 if (!err_union_val) return ira->codegen->builtin_types.entry_invalid;
1932619346 if (err_union_val->special != ConstValSpecialRuntime) {
1932719347 ErrorTableEntry *err = err_union_val->data.x_err_union.err;
1932819348 if (err != nullptr) {