authorgravatar for andrew@ziglang.orgAndrew Kelley <andrew@ziglang.org> 2020-08-03 22:07:21-07:00
committergravatar for andrew@ziglang.orgAndrew Kelley <andrew@ziglang.org> 2020-08-03 22:07:21-07:00
log0c598100d8dbcf94fa8916a8aa5dcf5f55ef6d46
treee440e716ca89030384cf7cb43ce0a279224534d8
parentedfede575c3113c3611b14a868e8d1e956ca9ef5

stage2: fix use-after-free of export symbol name

1 files changed, 7 insertions(+), 3 deletions(-)

src-self-hosted/Module.zig+7-3
...@@ -1673,6 +1673,7 @@ fn deleteDeclExports(self: *Module, decl: *Decl) void {...@@ -1673,6 +1673,7 @@ fn deleteDeclExports(self: *Module, decl: *Decl) void {
1673 entry.value.destroy(self.gpa);1673 entry.value.destroy(self.gpa);
1674 }1674 }
1675 _ = self.symbol_exports.remove(exp.options.name);1675 _ = self.symbol_exports.remove(exp.options.name);
1676 self.gpa.free(exp.options.name);
1676 self.gpa.destroy(exp);1677 self.gpa.destroy(exp);
1677 }1678 }
1678 self.gpa.free(kv.value);1679 self.gpa.free(kv.value);
...@@ -1773,7 +1774,7 @@ pub fn resolveDefinedValue(self: *Module, scope: *Scope, base: *Inst) !?Value {...@@ -1773,7 +1774,7 @@ pub fn resolveDefinedValue(self: *Module, scope: *Scope, base: *Inst) !?Value {
1773 return null;1774 return null;
1774}1775}
17751776
1776pub fn analyzeExport(self: *Module, scope: *Scope, src: usize, symbol_name: []const u8, exported_decl: *Decl) !void {1777pub fn analyzeExport(self: *Module, scope: *Scope, src: usize, borrowed_symbol_name: []const u8, exported_decl: *Decl) !void {
1777 try self.ensureDeclAnalyzed(exported_decl);1778 try self.ensureDeclAnalyzed(exported_decl);
1778 const typed_value = exported_decl.typed_value.most_recent.typed_value;1779 const typed_value = exported_decl.typed_value.most_recent.typed_value;
1779 switch (typed_value.ty.zigTypeTag()) {1780 switch (typed_value.ty.zigTypeTag()) {
...@@ -1787,6 +1788,9 @@ pub fn analyzeExport(self: *Module, scope: *Scope, src: usize, symbol_name: []co...@@ -1787,6 +1788,9 @@ pub fn analyzeExport(self: *Module, scope: *Scope, src: usize, symbol_name: []co
1787 const new_export = try self.gpa.create(Export);1788 const new_export = try self.gpa.create(Export);
1788 errdefer self.gpa.destroy(new_export);1789 errdefer self.gpa.destroy(new_export);
17891790
1791 const symbol_name = try self.gpa.dupe(u8, borrowed_symbol_name);
1792 errdefer self.gpa.free(symbol_name);
1793
1790 const owner_decl = scope.decl().?;1794 const owner_decl = scope.decl().?;
17911795
1792 new_export.* = .{1796 new_export.* = .{
...@@ -1799,7 +1803,7 @@ pub fn analyzeExport(self: *Module, scope: *Scope, src: usize, symbol_name: []co...@@ -1799,7 +1803,7 @@ pub fn analyzeExport(self: *Module, scope: *Scope, src: usize, symbol_name: []co
1799 };1803 };
18001804
1801 // Add to export_owners table.1805 // Add to export_owners table.
1802 const eo_gop = self.export_owners.getOrPut(self.gpa, owner_decl) catch unreachable;1806 const eo_gop = self.export_owners.getOrPutAssumeCapacity(owner_decl);
1803 if (!eo_gop.found_existing) {1807 if (!eo_gop.found_existing) {
1804 eo_gop.entry.value = &[0]*Export{};1808 eo_gop.entry.value = &[0]*Export{};
1805 }1809 }
...@@ -1808,7 +1812,7 @@ pub fn analyzeExport(self: *Module, scope: *Scope, src: usize, symbol_name: []co...@@ -1808,7 +1812,7 @@ pub fn analyzeExport(self: *Module, scope: *Scope, src: usize, symbol_name: []co
1808 errdefer eo_gop.entry.value = self.gpa.shrink(eo_gop.entry.value, eo_gop.entry.value.len - 1);1812 errdefer eo_gop.entry.value = self.gpa.shrink(eo_gop.entry.value, eo_gop.entry.value.len - 1);
18091813
1810 // Add to exported_decl table.1814 // Add to exported_decl table.
1811 const de_gop = self.decl_exports.getOrPut(self.gpa, exported_decl) catch unreachable;1815 const de_gop = self.decl_exports.getOrPutAssumeCapacity(exported_decl);
1812 if (!de_gop.found_existing) {1816 if (!de_gop.found_existing) {
1813 de_gop.entry.value = &[0]*Export{};1817 de_gop.entry.value = &[0]*Export{};
1814 }1818 }