authorgravatar for andrew@ziglang.orgAndrew Kelley <andrew@ziglang.org> 2023-06-02 00:53:33-07:00
committergravatar for andrew@ziglang.orgAndrew Kelley <andrew@ziglang.org> 2023-06-10 20:47:59-07:00
log35550c840b07df017b360c81c3cd0a8a3da55aae
treeab630dcbac6cf7eff26c95e34ad13d3bad882055
parentf1c900c72e0d941fb2ab87197485c710fc95450b

Module: fix populateTestFunctions UAF


1 files changed, 6 insertions(+), 3 deletions(-)

src/Module.zig+6-3
......@@ -6322,11 +6322,12 @@ pub fn populateTestFunctions(
63226322 main_progress_node: *std.Progress.Node,
63236323) !void {
63246324 const gpa = mod.gpa;
6325 const ip = &mod.intern_pool;
63256326 const builtin_pkg = mod.main_pkg.table.get("builtin").?;
63266327 const builtin_file = (mod.importPkg(builtin_pkg) catch unreachable).file;
63276328 const root_decl = mod.declPtr(builtin_file.root_decl.unwrap().?);
63286329 const builtin_namespace = mod.namespacePtr(root_decl.src_namespace);
6329 const test_functions_str = try mod.intern_pool.getOrPutString(gpa, "test_functions");
6330 const test_functions_str = try ip.getOrPutString(gpa, "test_functions");
63306331 const decl_index = builtin_namespace.decls.getKeyAdapted(
63316332 test_functions_str,
63326333 DeclAdapter{ .mod = mod },
......@@ -6362,7 +6363,9 @@ pub fn populateTestFunctions(
63626363
63636364 for (test_fn_vals, mod.test_functions.keys()) |*test_fn_val, test_decl_index| {
63646365 const test_decl = mod.declPtr(test_decl_index);
6365 const test_decl_name = mod.intern_pool.stringToSlice(test_decl.name);
6366 // Protects test_decl_name from being invalidated during call to intern() below.
6367 try ip.string_bytes.ensureUnusedCapacity(gpa, ip.stringToSlice(test_decl.name).len + 10);
6368 const test_decl_name = ip.stringToSlice(test_decl.name);
63666369 const test_name_decl_index = n: {
63676370 const test_name_decl_ty = try mod.arrayType(.{
63686371 .len = test_decl_name.len,
......@@ -6444,7 +6447,7 @@ pub fn populateTestFunctions(
64446447 .addr = .{ .decl = array_decl_index },
64456448 .len = (try mod.intValue(Type.usize, mod.test_functions.count())).toIntern(),
64466449 } });
6447 mod.intern_pool.mutateVarInit(decl.val.toIntern(), new_init);
6450 ip.mutateVarInit(decl.val.toIntern(), new_init);
64486451
64496452 // Since we are replacing the Decl's value we must perform cleanup on the
64506453 // previous value.