Do not read past array end in struct return

herman ten brugge committed 1 year ago

Commit fa979541 parent 9dffcd23 files · +29 −5Browse files

Unified · Split

3 files

@@ -6706,11 +6706,16 @@ static void gfunc_return(CType *func_type) · 6705 unmodified lines
6706	6706	/* returning structure packed into registers */
6707	6707	int size, addr, align, rc, n;
6708	6708	size = type_size(func_type,&align);
6709		− if ((align & (ret_align - 1))
6710		− && ((vtop->r & VT_VALMASK) < VT_CONST /* pointer to struct */
6711		− \|\| (vtop->c.i & (ret_align - 1))
6712		− )) {
6713		− loc = (loc - size) & -ret_align;
	6709	+ if (ret_nregs * regsize > size \|\|
	6710	+ ((align & (ret_align - 1))
	6711	+ && ((vtop->r & VT_VALMASK) < VT_CONST /* pointer to struct */
	6712	+ \|\| (vtop->c.i & (ret_align - 1))
	6713	+ ))) {
	6714	+ if (ret_nregs * regsize > size)
	6715	+ size = ret_nregs * regsize;
	6716	+ if (ret_align > align)
	6717	+ align = ret_align;
	6718	+ loc = (loc - size) & -align;
6714	6719	addr = loc;
6715	6720	type = *func_type;
6716	6721	vset(&type, VT_LOCAL \| VT_LVAL, addr);

@@ -6,6 +6,10 @@ typedef struct { · 5 unmodified lines
6	6	double d2;
7	7	} Node;
8	8
	9	+typedef struct {
	10	+ int a, b, c;
	11	+} A;
	12	+
9	13	Node init(Node self) {
10	14	self.data[0] = 0;
11	15	self.data[1] = 1;
@@ -25,11 +29,25 @@ void print_data(Node data) { · 13 unmodified lines
25	29	data.d1, data.d2);
26	30	}
27	31
	32	+A test(void)
	33	+{
	34	+ int i;
	35	+ A arr[30];
	36	+
	37	+ for (i = 0; i < 30; i++)
	38	+ arr[i].b = i;
	39	+ return arr[29];
	40	+}
	41	+
28	42	int main(void) {
29	43	/* This code resulted in a bounds checking error */
30	44	Node data;
	45	+ A a;
31	46	dummy (data);
32	47	char val;
33	48	data = init (data);
34	49	print_data(data);
	50	+ a = test();
	51	+ printf("%d\n", a.b);
	52	+ return 0;
35	53	}

Keyboard shortcuts