Fix a VLA problem

see testcase, reduced example of a situation reported by Kyryl Melekhin in https://github.com/kyx0r/neatvi/ . Problem is that setting up the VLA sp-save in a scope that isn't entered at runtime leaves traces of it in outer scopes that then try to restore the stack pointer from uninitialized slots.

Michael Matz committed 5 years ago

Commit fbef90a1 parent d6f2d584 files · +69 −12Browse files

Unified · Split

4 files

tccgen.c +18 −9
tests/tests2/123_vla_bug.c +40 −0
tests/tests2/123_vla_bug.expect +5 −0
tests/tests2/79_vla_continue.c +6 −3

tccgen.c+18−9

 static struct scope {
     struct scope *prev;
-    struct { int loc, num; } vla;
+    struct { int loc, locorig, num; } vla;
     struct { Sym *s; int n; } cl;
     int *bsym, *csym;
     Sym *lstk, *llstk;
 static void vla_leave(struct scope *o)
 {
-    if (o->vla.num < cur_scope->vla.num)
+    struct scope *c = cur_scope, *v = NULL;
-        vla_restore(o->vla.loc);
+    for (; c != o && c; c = c->prev)
+      if (c->vla.num)
+        v = c;
+    if (v)
+      vla_restore(v->vla.locorig);
 }
 /* ------------------------------------------------------------------------- */
     *o = *cur_scope;
     o->prev = cur_scope;
     cur_scope = o;
+    cur_scope->vla.num = 0;
     /* record local declaration stack position */
     o->lstk = local_stack;
         goto block_after_label;
     } else if (t == TOK_GOTO) {
-        vla_restore(root_scope->vla.loc);
+        if (cur_scope->vla.num)
+          vla_restore(cur_scope->vla.locorig);
         if (tok == '*' && gnu_ext) {
             /* computed goto */
             next();
         if (NODATA_WANTED)
             goto no_alloc;
-        /* save current stack pointer */
+        /* save before-VLA stack pointer if needed */
-        if (root_scope->vla.loc == 0) {
+        if (cur_scope->vla.num == 0) {
-            struct scope *v = cur_scope;
+            if (cur_scope->prev && cur_scope->prev->vla.num) {
-            gen_vla_sp_save(loc -= PTR_SIZE);
+                cur_scope->vla.locorig = cur_scope->prev->vla.loc;
-            do v->vla.loc = loc; while ((v = v->prev));
+            } else {
+                gen_vla_sp_save(loc -= PTR_SIZE);
+                cur_scope->vla.locorig = loc;
+            }
         }
         vla_runtime_type_size(type, &a);

tests/tests2/123_vla_bug.c+40−0

@@ -0,0 +1,40 @@
	1	typedef __SIZE_TYPE__ size_t;
	2	extern int printf(const char*, ...);
	3	extern size_t strlen(const char*);
	4	char str[] = "blabla";
	5	int g;
	6	int main()
	7	{
	8	//char helpme[strlen(str) + 1];
	9	int i = 0;
	10	#if 0
	11	if (g) {
	12	char buf[strlen(str) + 10];
	13	buf[0] = 0;
	14	}
	15	alabel:
	16	printf("default: i = %d\n", i);
	17	#else
	18	for (i = 0; i < 5; i++) {
	19	switch (i) {
	20	case 10:
	21	if (g) {
	22	char buf[strlen(str) + 10];
	23	buf[0] = 0;
	24	goto do_cmd;
	25	}
	26	break;
	27	case 1:
	28	printf("reached 3\n");
	29	do_cmd:
	30	printf("after do_cmd");
	31	break;
	32	default:
	33	g++;
	34	printf("default: i = %d\n", i);
	35	break;
	36	}
	37	}
	38	#endif
	39	return 0;
	40	}

tests/tests2/123_vla_bug.expect+5−0

@@ -0,0 +1,5 @@
	1	default: i = 0
	2	reached 3
	3	after do_cmddefault: i = 2
	4	default: i = 3
	5	default: i = 4

tests/tests2/79_vla_continue.c+6−3

   int count = 10;
   void *addr[count];
   while(count--) {
-    int a[f()];
+      int b[f()];
+      if (count >= 0) {
+          int a[f()];
-    addr[count] = a;
+          addr[count] = a;
-    continue;
+          continue;
+      }
   }
   if(addr[9] == addr[0]) {

Fix a VLA problem

Keyboard shortcuts

General

Issues and pull requests

Issues, pull requests and Inbox

Repository code