From 6ef6945c9cbb0ab43f3b04e97f0a2285494a9c87 Mon Sep 17 00:00:00 2001 From: Trevor Saunders Date: Tue, 5 Aug 2014 19:52:08 +0000 Subject: fix pr62009 use after free in redirect_edge_var_map_dup The change to get the entry for the old edge before inserting the new one was incorrect because if inserting the new one resized the table then the pointer to the entry for the old one would become invalid. gcc/ * tree-ssa.c (redirect_edge_var_map_dup): insert newe before getting olde. From-SVN: r213644 --- gcc/ChangeLog | 5 +++++ gcc/tree-ssa.c | 7 ++++--- 2 files changed, 9 insertions(+), 3 deletions(-) (limited to 'gcc') diff --git a/gcc/ChangeLog b/gcc/ChangeLog index f199fed..17a0f2d 100644 --- a/gcc/ChangeLog +++ b/gcc/ChangeLog @@ -1,3 +1,8 @@ +2014-08-05 Trevor Saunders + + * tree-ssa.c (redirect_edge_var_map_dup): insert newe before + getting olde. + 2014-08-05 Richard Biener PR rtl-optimization/61672 diff --git a/gcc/tree-ssa.c b/gcc/tree-ssa.c index 217b9fc..e684296 100644 --- a/gcc/tree-ssa.c +++ b/gcc/tree-ssa.c @@ -106,11 +106,12 @@ redirect_edge_var_map_dup (edge newe, edge olde) if (!edge_var_maps) return; - auto_vec *head = edge_var_maps->get (olde); - if (!head) + auto_vec *new_head = &edge_var_maps->get_or_insert (newe); + auto_vec *old_head = edge_var_maps->get (olde); + if (!old_head) return; - edge_var_maps->get_or_insert (newe).safe_splice (*head); + new_head->safe_splice (*old_head); } -- cgit v1.1