Do not read past array end in struct return

herman ten brugge committed 1 year ago

Commit fa979541 parent 9dffcd23 files · +29 −5Browse files

Unified · Split

3 files

             /* returning structure packed into registers */
             int size, addr, align, rc, n;
             size = type_size(func_type,&align);
-            if ((align & (ret_align - 1))
+            if (ret_nregs * regsize > size ||
-                && ((vtop->r & VT_VALMASK) < VT_CONST /* pointer to struct */
+		((align & (ret_align - 1))
-                    || (vtop->c.i & (ret_align - 1))
+                 && ((vtop->r & VT_VALMASK) < VT_CONST /* pointer to struct */
-                    )) {
+                     || (vtop->c.i & (ret_align - 1))
-                loc = (loc - size) & -ret_align;
+                     ))) {
+		if (ret_nregs * regsize > size)
+		    size = ret_nregs * regsize;
+		if (ret_align > align)
+		    align = ret_align;
+                loc = (loc - size) & -align;
                 addr = loc;
                 type = *func_type;
                 vset(&type, VT_LOCAL | VT_LVAL, addr);

@@ -6,6 +6,10 @@ typedef struct { · 5 unmodified lines
6	double d2;	6	double d2;
7	} Node;	7	} Node;
8		8
		9	typedef struct {
		10	int a, b, c;
		11	} A;
		12
9	Node init(Node self) {	13	Node init(Node self) {
10	self.data[0] = 0;	14	self.data[0] = 0;
11	self.data[1] = 1;	15	self.data[1] = 1;
@@ -25,11 +29,25 @@ void print_data(Node data) { · 13 unmodified lines
25	data.d1, data.d2);	29	data.d1, data.d2);
26	}	30	}
27		31
		32	A test(void)
		33	{
		34	int i;
		35	A arr[30];
		36
		37	for (i = 0; i < 30; i++)
		38	arr[i].b = i;
		39	return arr[29];
		40	}
		41
28	int main(void) {	42	int main(void) {
29	/* This code resulted in a bounds checking error */	43	/* This code resulted in a bounds checking error */
30	Node data;	44	Node data;
		45	A a;
31	dummy (data);	46	dummy (data);
32	char val;	47	char val;
33	data = init (data);	48	data = init (data);
34	print_data(data);	49	print_data(data);
		50	a = test();
		51	printf("%d\n", a.b);
		52	return 0;
35	}	53	}

Keyboard shortcuts