authorgravatar for kris.tate+github@gmail.comkristopher tate <kris.tate+github@gmail.com> 2018-08-27 01:22:50+09:00
committergravatar for andrew@ziglang.orgAndrew Kelley <andrew@ziglang.org> 2018-08-26 13:02:09-04:00
log0839ed1f945dbbe3ad1f780a5334ad16ad12fd5e
tree0c5e1bf991b7183f443038be1be7db36c17bbe84
parent8047f0eae2da64a88474dbe9106c61b3e26e6871

src/ir.cpp: check return value of `const_ptr_pointee` to protect against dereferencing null pointers;

1 files changed, 21 insertions(+), 1 deletions(-)

src/ir.cpp+21-1
...@@ -10982,6 +10982,7 @@ static IrInstruction *ir_get_deref(IrAnalyze *ira, IrInstruction *source_instruc...@@ -10982,6 +10982,7 @@ static IrInstruction *ir_get_deref(IrAnalyze *ira, IrInstruction *source_instruc
10982 ptr->value.data.x_ptr.mut == ConstPtrMutComptimeVar)10982 ptr->value.data.x_ptr.mut == ConstPtrMutComptimeVar)
10983 {10983 {
10984 ConstExprValue *pointee = const_ptr_pointee(ira->codegen, &ptr->value);10984 ConstExprValue *pointee = const_ptr_pointee(ira->codegen, &ptr->value);
10985 if (!pointee) return ira->codegen->invalid_instruction;
10985 if (pointee->special != ConstValSpecialRuntime) {10986 if (pointee->special != ConstValSpecialRuntime) {
10986 IrInstruction *result = ir_create_const(&ira->new_irb, source_instruction->scope,10987 IrInstruction *result = ir_create_const(&ira->new_irb, source_instruction->scope,
10987 source_instruction->source_node, child_type);10988 source_instruction->source_node, child_type);
...@@ -13655,6 +13656,7 @@ static TypeTableEntry *ir_analyze_dereference(IrAnalyze *ira, IrInstructionUnOp...@@ -13655,6 +13656,7 @@ static TypeTableEntry *ir_analyze_dereference(IrAnalyze *ira, IrInstructionUnOp
13655 return ira->codegen->builtin_types.entry_invalid;13656 return ira->codegen->builtin_types.entry_invalid;
1365613657
13657 ConstExprValue *pointee = const_ptr_pointee(ira->codegen, comptime_value);13658 ConstExprValue *pointee = const_ptr_pointee(ira->codegen, comptime_value);
13659 if (!pointee) return ira->codegen->builtin_types.entry_invalid;
13658 if (pointee->type == child_type) {13660 if (pointee->type == child_type) {
13659 ConstExprValue *out_val = ir_build_const_from(ira, &un_op_instruction->base);13661 ConstExprValue *out_val = ir_build_const_from(ira, &un_op_instruction->base);
13660 copy_const_val(out_val, pointee, value->value.data.x_ptr.mut == ConstPtrMutComptimeConst);13662 copy_const_val(out_val, pointee, value->value.data.x_ptr.mut == ConstPtrMutComptimeConst);
...@@ -14058,6 +14060,7 @@ static TypeTableEntry *ir_analyze_instruction_elem_ptr(IrAnalyze *ira, IrInstruc...@@ -14058,6 +14060,7 @@ static TypeTableEntry *ir_analyze_instruction_elem_ptr(IrAnalyze *ira, IrInstruc
14058 ptr_type = ptr_type->data.pointer.child_type;14060 ptr_type = ptr_type->data.pointer.child_type;
14059 if (orig_array_ptr_val->special != ConstValSpecialRuntime) {14061 if (orig_array_ptr_val->special != ConstValSpecialRuntime) {
14060 orig_array_ptr_val = const_ptr_pointee(ira->codegen, orig_array_ptr_val);14062 orig_array_ptr_val = const_ptr_pointee(ira->codegen, orig_array_ptr_val);
14063 if (!orig_array_ptr_val) return ira->codegen->builtin_types.entry_invalid;
14061 }14064 }
14062 }14065 }
14063 if (array_type->data.array.len == 0) {14066 if (array_type->data.array.len == 0) {
...@@ -14099,6 +14102,7 @@ static TypeTableEntry *ir_analyze_instruction_elem_ptr(IrAnalyze *ira, IrInstruc...@@ -14099,6 +14102,7 @@ static TypeTableEntry *ir_analyze_instruction_elem_ptr(IrAnalyze *ira, IrInstruc
14099 if (!ptr_val)14102 if (!ptr_val)
14100 return ira->codegen->builtin_types.entry_invalid;14103 return ira->codegen->builtin_types.entry_invalid;
14101 ConstExprValue *args_val = const_ptr_pointee(ira->codegen, ptr_val);14104 ConstExprValue *args_val = const_ptr_pointee(ira->codegen, ptr_val);
14105 if (!args_val) return ira->codegen->builtin_types.entry_invalid;
14102 size_t start = args_val->data.x_arg_tuple.start_index;14106 size_t start = args_val->data.x_arg_tuple.start_index;
14103 size_t end = args_val->data.x_arg_tuple.end_index;14107 size_t end = args_val->data.x_arg_tuple.end_index;
14104 uint64_t elem_index_val;14108 uint64_t elem_index_val;
...@@ -14380,6 +14384,7 @@ static IrInstruction *ir_analyze_container_field_ptr(IrAnalyze *ira, Buf *field_...@@ -14380,6 +14384,7 @@ static IrInstruction *ir_analyze_container_field_ptr(IrAnalyze *ira, Buf *field_
1438014384
14381 if (ptr_val->data.x_ptr.special != ConstPtrSpecialHardCodedAddr) {14385 if (ptr_val->data.x_ptr.special != ConstPtrSpecialHardCodedAddr) {
14382 ConstExprValue *struct_val = const_ptr_pointee(ira->codegen, ptr_val);14386 ConstExprValue *struct_val = const_ptr_pointee(ira->codegen, ptr_val);
14387 if (!struct_val) return ira->codegen->invalid_instruction;
14383 if (type_is_invalid(struct_val->type))14388 if (type_is_invalid(struct_val->type))
14384 return ira->codegen->invalid_instruction;14389 return ira->codegen->invalid_instruction;
14385 ConstExprValue *field_val = &struct_val->data.x_struct.fields[field->src_index];14390 ConstExprValue *field_val = &struct_val->data.x_struct.fields[field->src_index];
...@@ -14422,6 +14427,7 @@ static IrInstruction *ir_analyze_container_field_ptr(IrAnalyze *ira, Buf *field_...@@ -14422,6 +14427,7 @@ static IrInstruction *ir_analyze_container_field_ptr(IrAnalyze *ira, Buf *field_
1442214427
14423 if (ptr_val->data.x_ptr.special != ConstPtrSpecialHardCodedAddr) {14428 if (ptr_val->data.x_ptr.special != ConstPtrSpecialHardCodedAddr) {
14424 ConstExprValue *union_val = const_ptr_pointee(ira->codegen, ptr_val);14429 ConstExprValue *union_val = const_ptr_pointee(ira->codegen, ptr_val);
14430 if (!union_val) return ira->codegen->invalid_instruction;
14425 if (type_is_invalid(union_val->type))14431 if (type_is_invalid(union_val->type))
14426 return ira->codegen->invalid_instruction;14432 return ira->codegen->invalid_instruction;
1442714433
...@@ -14618,6 +14624,7 @@ static TypeTableEntry *ir_analyze_instruction_field_ptr(IrAnalyze *ira, IrInstru...@@ -14618,6 +14624,7 @@ static TypeTableEntry *ir_analyze_instruction_field_ptr(IrAnalyze *ira, IrInstru
1461814624
14619 assert(container_ptr->value.type->id == TypeTableEntryIdPointer);14625 assert(container_ptr->value.type->id == TypeTableEntryIdPointer);
14620 ConstExprValue *child_val = const_ptr_pointee(ira->codegen, container_ptr_val);14626 ConstExprValue *child_val = const_ptr_pointee(ira->codegen, container_ptr_val);
14627 if (!child_val) return ira->codegen->builtin_types.entry_invalid;
1462114628
14622 if (buf_eql_str(field_name, "len")) {14629 if (buf_eql_str(field_name, "len")) {
14623 ConstExprValue *len_val = create_const_vals(1);14630 ConstExprValue *len_val = create_const_vals(1);
...@@ -14642,6 +14649,7 @@ static TypeTableEntry *ir_analyze_instruction_field_ptr(IrAnalyze *ira, IrInstru...@@ -14642,6 +14649,7 @@ static TypeTableEntry *ir_analyze_instruction_field_ptr(IrAnalyze *ira, IrInstru
1464214649
14643 assert(container_ptr->value.type->id == TypeTableEntryIdPointer);14650 assert(container_ptr->value.type->id == TypeTableEntryIdPointer);
14644 ConstExprValue *child_val = const_ptr_pointee(ira->codegen, container_ptr_val);14651 ConstExprValue *child_val = const_ptr_pointee(ira->codegen, container_ptr_val);
14652 if (!child_val) return ira->codegen->builtin_types.entry_invalid;
14645 TypeTableEntry *child_type = child_val->data.x_type;14653 TypeTableEntry *child_type = child_val->data.x_type;
1464614654
14647 if (type_is_invalid(child_type)) {14655 if (type_is_invalid(child_type)) {
...@@ -14910,6 +14918,7 @@ static TypeTableEntry *ir_analyze_instruction_field_ptr(IrAnalyze *ira, IrInstru...@@ -14910,6 +14918,7 @@ static TypeTableEntry *ir_analyze_instruction_field_ptr(IrAnalyze *ira, IrInstru
14910 return ira->codegen->builtin_types.entry_invalid;14918 return ira->codegen->builtin_types.entry_invalid;
1491114919
14912 ConstExprValue *namespace_val = const_ptr_pointee(ira->codegen, container_ptr_val);14920 ConstExprValue *namespace_val = const_ptr_pointee(ira->codegen, container_ptr_val);
14921 if (!namespace_val) return ira->codegen->builtin_types.entry_invalid;
14913 assert(namespace_val->special == ConstValSpecialStatic);14922 assert(namespace_val->special == ConstValSpecialStatic);
1491414923
14915 ImportTableEntry *namespace_import = namespace_val->data.x_import;14924 ImportTableEntry *namespace_import = namespace_val->data.x_import;
...@@ -14986,6 +14995,7 @@ static TypeTableEntry *ir_analyze_instruction_store_ptr(IrAnalyze *ira, IrInstru...@@ -14986,6 +14995,7 @@ static TypeTableEntry *ir_analyze_instruction_store_ptr(IrAnalyze *ira, IrInstru
14986 if (ptr->value.data.x_ptr.mut == ConstPtrMutComptimeVar) {14995 if (ptr->value.data.x_ptr.mut == ConstPtrMutComptimeVar) {
14987 if (instr_is_comptime(casted_value)) {14996 if (instr_is_comptime(casted_value)) {
14988 ConstExprValue *dest_val = const_ptr_pointee(ira->codegen, &ptr->value);14997 ConstExprValue *dest_val = const_ptr_pointee(ira->codegen, &ptr->value);
14998 if (!dest_val) return ira->codegen->builtin_types.entry_invalid;
14989 if (dest_val->special != ConstValSpecialRuntime) {14999 if (dest_val->special != ConstValSpecialRuntime) {
14990 *dest_val = casted_value->value;15000 *dest_val = casted_value->value;
14991 if (!ira->new_irb.current_basic_block->must_be_comptime_source_instr) {15001 if (!ira->new_irb.current_basic_block->must_be_comptime_source_instr) {
...@@ -14997,6 +15007,7 @@ static TypeTableEntry *ir_analyze_instruction_store_ptr(IrAnalyze *ira, IrInstru...@@ -14997,6 +15007,7 @@ static TypeTableEntry *ir_analyze_instruction_store_ptr(IrAnalyze *ira, IrInstru
14997 ir_add_error(ira, &store_ptr_instruction->base,15007 ir_add_error(ira, &store_ptr_instruction->base,
14998 buf_sprintf("cannot store runtime value in compile time variable"));15008 buf_sprintf("cannot store runtime value in compile time variable"));
14999 ConstExprValue *dest_val = const_ptr_pointee(ira->codegen, &ptr->value);15009 ConstExprValue *dest_val = const_ptr_pointee(ira->codegen, &ptr->value);
15010 if (!dest_val) return ira->codegen->builtin_types.entry_invalid;
15000 dest_val->type = ira->codegen->builtin_types.entry_invalid;15011 dest_val->type = ira->codegen->builtin_types.entry_invalid;
1500115012
15002 return ira->codegen->builtin_types.entry_invalid;15013 return ira->codegen->builtin_types.entry_invalid;
...@@ -15850,7 +15861,7 @@ static TypeTableEntry *ir_analyze_instruction_switch_target(IrAnalyze *ira,...@@ -15850,7 +15861,7 @@ static TypeTableEntry *ir_analyze_instruction_switch_target(IrAnalyze *ira,
15850 ConstExprValue *pointee_val = nullptr;15861 ConstExprValue *pointee_val = nullptr;
15851 if (instr_is_comptime(target_value_ptr)) {15862 if (instr_is_comptime(target_value_ptr)) {
15852 pointee_val = const_ptr_pointee(ira->codegen, &target_value_ptr->value);15863 pointee_val = const_ptr_pointee(ira->codegen, &target_value_ptr->value);
15853 if (pointee_val->special == ConstValSpecialRuntime)15864 if (pointee_val && pointee_val->special == ConstValSpecialRuntime)
15854 pointee_val = nullptr;15865 pointee_val = nullptr;
15855 }15866 }
15856 if ((err = ensure_complete_type(ira->codegen, target_type)))15867 if ((err = ensure_complete_type(ira->codegen, target_type)))
...@@ -15981,6 +15992,7 @@ static TypeTableEntry *ir_analyze_instruction_switch_var(IrAnalyze *ira, IrInstr...@@ -15981,6 +15992,7 @@ static TypeTableEntry *ir_analyze_instruction_switch_var(IrAnalyze *ira, IrInstr
15981 return ira->codegen->builtin_types.entry_invalid;15992 return ira->codegen->builtin_types.entry_invalid;
1598215993
15983 ConstExprValue *pointee_val = const_ptr_pointee(ira->codegen, target_val_ptr);15994 ConstExprValue *pointee_val = const_ptr_pointee(ira->codegen, target_val_ptr);
15995 if (!pointee_val) return ira->codegen->builtin_types.entry_invalid;
15984 ConstExprValue *out_val = ir_build_const_from(ira, &instruction->base);15996 ConstExprValue *out_val = ir_build_const_from(ira, &instruction->base);
15985 out_val->data.x_ptr.special = ConstPtrSpecialRef;15997 out_val->data.x_ptr.special = ConstPtrSpecialRef;
15986 out_val->data.x_ptr.mut = target_val_ptr->data.x_ptr.mut;15998 out_val->data.x_ptr.mut = target_val_ptr->data.x_ptr.mut;
...@@ -18732,11 +18744,14 @@ static TypeTableEntry *ir_analyze_instruction_slice(IrAnalyze *ira, IrInstructio...@@ -18732,11 +18744,14 @@ static TypeTableEntry *ir_analyze_instruction_slice(IrAnalyze *ira, IrInstructio
18732 TypeTableEntry *child_array_type = array_type->data.pointer.child_type;18744 TypeTableEntry *child_array_type = array_type->data.pointer.child_type;
18733 assert(child_array_type->id == TypeTableEntryIdArray);18745 assert(child_array_type->id == TypeTableEntryIdArray);
18734 parent_ptr = const_ptr_pointee(ira->codegen, &ptr_ptr->value);18746 parent_ptr = const_ptr_pointee(ira->codegen, &ptr_ptr->value);
18747 if (!parent_ptr) return ira->codegen->builtin_types.entry_invalid;
18735 array_val = const_ptr_pointee(ira->codegen, parent_ptr);18748 array_val = const_ptr_pointee(ira->codegen, parent_ptr);
18749 if (!array_val) return ira->codegen->builtin_types.entry_invalid;
18736 rel_end = child_array_type->data.array.len;18750 rel_end = child_array_type->data.array.len;
18737 abs_offset = 0;18751 abs_offset = 0;
18738 } else {18752 } else {
18739 array_val = const_ptr_pointee(ira->codegen, &ptr_ptr->value);18753 array_val = const_ptr_pointee(ira->codegen, &ptr_ptr->value);
18754 if (!array_val) return ira->codegen->builtin_types.entry_invalid;
18740 rel_end = array_type->data.array.len;18755 rel_end = array_type->data.array.len;
18741 parent_ptr = nullptr;18756 parent_ptr = nullptr;
18742 abs_offset = 0;18757 abs_offset = 0;
...@@ -18744,6 +18759,7 @@ static TypeTableEntry *ir_analyze_instruction_slice(IrAnalyze *ira, IrInstructio...@@ -18744,6 +18759,7 @@ static TypeTableEntry *ir_analyze_instruction_slice(IrAnalyze *ira, IrInstructio
18744 } else if (array_type->id == TypeTableEntryIdPointer) {18759 } else if (array_type->id == TypeTableEntryIdPointer) {
18745 assert(array_type->data.pointer.ptr_len == PtrLenUnknown);18760 assert(array_type->data.pointer.ptr_len == PtrLenUnknown);
18746 parent_ptr = const_ptr_pointee(ira->codegen, &ptr_ptr->value);18761 parent_ptr = const_ptr_pointee(ira->codegen, &ptr_ptr->value);
18762 if (!parent_ptr) return ira->codegen->builtin_types.entry_invalid;
18747 if (parent_ptr->special == ConstValSpecialUndef) {18763 if (parent_ptr->special == ConstValSpecialUndef) {
18748 array_val = nullptr;18764 array_val = nullptr;
18749 abs_offset = 0;18765 abs_offset = 0;
...@@ -18775,6 +18791,7 @@ static TypeTableEntry *ir_analyze_instruction_slice(IrAnalyze *ira, IrInstructio...@@ -18775,6 +18791,7 @@ static TypeTableEntry *ir_analyze_instruction_slice(IrAnalyze *ira, IrInstructio
18775 }18791 }
18776 } else if (is_slice(array_type)) {18792 } else if (is_slice(array_type)) {
18777 ConstExprValue *slice_ptr = const_ptr_pointee(ira->codegen, &ptr_ptr->value);18793 ConstExprValue *slice_ptr = const_ptr_pointee(ira->codegen, &ptr_ptr->value);
18794 if (!slice_ptr) return ira->codegen->builtin_types.entry_invalid;
18778 parent_ptr = &slice_ptr->data.x_struct.fields[slice_ptr_index];18795 parent_ptr = &slice_ptr->data.x_struct.fields[slice_ptr_index];
18779 ConstExprValue *len_val = &slice_ptr->data.x_struct.fields[slice_len_index];18796 ConstExprValue *len_val = &slice_ptr->data.x_struct.fields[slice_len_index];
1878018797
...@@ -19175,6 +19192,7 @@ static TypeTableEntry *ir_analyze_instruction_overflow_op(IrAnalyze *ira, IrInst...@@ -19175,6 +19192,7 @@ static TypeTableEntry *ir_analyze_instruction_overflow_op(IrAnalyze *ira, IrInst
19175 BigInt *op1_bigint = &casted_op1->value.data.x_bigint;19192 BigInt *op1_bigint = &casted_op1->value.data.x_bigint;
19176 BigInt *op2_bigint = &casted_op2->value.data.x_bigint;19193 BigInt *op2_bigint = &casted_op2->value.data.x_bigint;
19177 ConstExprValue *pointee_val = const_ptr_pointee(ira->codegen, &casted_result_ptr->value);19194 ConstExprValue *pointee_val = const_ptr_pointee(ira->codegen, &casted_result_ptr->value);
19195 if (!pointee_val) return ira->codegen->builtin_types.entry_invalid;
19178 BigInt *dest_bigint = &pointee_val->data.x_bigint;19196 BigInt *dest_bigint = &pointee_val->data.x_bigint;
19179 switch (instruction->op) {19197 switch (instruction->op) {
19180 case IrOverflowOpAdd:19198 case IrOverflowOpAdd:
...@@ -19275,6 +19293,7 @@ static TypeTableEntry *ir_analyze_instruction_unwrap_err_code(IrAnalyze *ira,...@@ -19275,6 +19293,7 @@ static TypeTableEntry *ir_analyze_instruction_unwrap_err_code(IrAnalyze *ira,
19275 if (!ptr_val)19293 if (!ptr_val)
19276 return ira->codegen->builtin_types.entry_invalid;19294 return ira->codegen->builtin_types.entry_invalid;
19277 ConstExprValue *err_union_val = const_ptr_pointee(ira->codegen, ptr_val);19295 ConstExprValue *err_union_val = const_ptr_pointee(ira->codegen, ptr_val);
19296 if (!err_union_val) return ira->codegen->builtin_types.entry_invalid;
19278 if (err_union_val->special != ConstValSpecialRuntime) {19297 if (err_union_val->special != ConstValSpecialRuntime) {
19279 ErrorTableEntry *err = err_union_val->data.x_err_union.err;19298 ErrorTableEntry *err = err_union_val->data.x_err_union.err;
19280 assert(err);19299 assert(err);
...@@ -19323,6 +19342,7 @@ static TypeTableEntry *ir_analyze_instruction_unwrap_err_payload(IrAnalyze *ira,...@@ -19323,6 +19342,7 @@ static TypeTableEntry *ir_analyze_instruction_unwrap_err_payload(IrAnalyze *ira,
19323 if (!ptr_val)19342 if (!ptr_val)
19324 return ira->codegen->builtin_types.entry_invalid;19343 return ira->codegen->builtin_types.entry_invalid;
19325 ConstExprValue *err_union_val = const_ptr_pointee(ira->codegen, ptr_val);19344 ConstExprValue *err_union_val = const_ptr_pointee(ira->codegen, ptr_val);
19345 if (!err_union_val) return ira->codegen->builtin_types.entry_invalid;
19326 if (err_union_val->special != ConstValSpecialRuntime) {19346 if (err_union_val->special != ConstValSpecialRuntime) {
19327 ErrorTableEntry *err = err_union_val->data.x_err_union.err;19347 ErrorTableEntry *err = err_union_val->data.x_err_union.err;
19328 if (err != nullptr) {19348 if (err != nullptr) {