| author |  Robin Voetter <robin@voetter.nl> 2023-04-10 18:27:22+02:00 |
| committer | Robin Voetter <robin@voetter.nl> 2023-05-11 20:31:50+02:00 |
| log | 5d896a6cc6b7127dd4db0bd386ebe33da82d7824 |
| tree | 5644af71416f1bd3a5242d1e645bd2ca4c80ad00 |
| parent | 5e62ba1347ee9b8614d5d72c60e87136a3bd7ab9 |
| signature | Commit is signed but in an unrecognized format. |
spirv: fix use-after-realloc in resolveType()
The pointer to a slot in a hash map was fetched before a recursive call.
If the hash map's size changed during the recursive call, this would write
to an invalid pointer.
The solution is to use an index instead of a pointer. Note that care must be
taken that resolved types (from the type_cahce) must not be accessed, as they
might be incomplete during this operation.1 files changed, 5 insertions(+), 2 deletions(-)
src
codegen
spirv
src/codegen/spirv/Module.zig+5-2
| ... | ... | @@ -393,11 +393,14 @@ pub fn resolveSourceFileName(self: *Module, decl: *ZigDecl) !IdRef { |
| 393 | 393 | /// be emitted at this point. |
| 394 | 394 | pub fn resolveType(self: *Module, ty: Type) !Type.Ref { |
| 395 | 395 | const result = try self.type_cache.getOrPut(self.gpa, ty); |
| 396 | const index = @intToEnum(Type.Ref, result.index); | |
| 397 | ||
| 396 | 398 | if (!result.found_existing) { |
| 397 | result.value_ptr.* = try self.emitType(ty); | |
| 399 | const ref = try self.emitType(ty); | |
| 400 | self.type_cache.values()[result.index] = ref; | |
| 398 | 401 | } |
| 399 | 402 | |
| 400 | return @intToEnum(Type.Ref, result.index); | |
| 403 | return index; | |
| 401 | 404 | } |
| 402 | 405 | |
| 403 | 406 | pub fn resolveTypeId(self: *Module, ty: Type) !IdResultType { |