diff options
| author | Richard Sandiford <richard.sandiford@arm.com> | 2024-07-12 10:30:22 +0100 |
|---|---|---|
| committer | Richard Sandiford <richard.sandiford@arm.com> | 2024-07-12 10:30:22 +0100 |
| commit | 7bcef7532b10040bb82567136a208d0c4560767d (patch) | |
| tree | 981f8d85f746942372b8f8b33c9331b0bcec902d | |
| parent | 26dfb3f2d30f6d49ed126add9d123dcc6566385f (diff) | |
| download | gcc-7bcef7532b10040bb82567136a208d0c4560767d.zip gcc-7bcef7532b10040bb82567136a208d0c4560767d.tar.gz gcc-7bcef7532b10040bb82567136a208d0c4560767d.tar.bz2 | |
aarch64: Avoid alloca in target attribute parsing
The handling of the target attribute used alloca to allocate
a copy of unverified user input, which could exhaust the stack
if the input is too long. This patch converts it to auto_vecs
instead.
I wondered about converting it to use std::string, which we
already use elsewhere, but that would be more invasive and
controversial.
gcc/
* config/aarch64/aarch64.cc (aarch64_process_one_target_attr)
(aarch64_process_target_attr): Avoid alloca.
| -rw-r--r-- | gcc/config/aarch64/aarch64.cc | 12 |
1 files changed, 8 insertions, 4 deletions
diff --git a/gcc/config/aarch64/aarch64.cc b/gcc/config/aarch64/aarch64.cc index 7f0cc47..0d41a193 100644 --- a/gcc/config/aarch64/aarch64.cc +++ b/gcc/config/aarch64/aarch64.cc @@ -19405,8 +19405,10 @@ aarch64_process_one_target_attr (char *arg_str) return false; } - char *str_to_check = (char *) alloca (len + 1); - strcpy (str_to_check, arg_str); + auto_vec<char, 32> buffer; + buffer.safe_grow (len + 1); + char *str_to_check = buffer.address (); + memcpy (str_to_check, arg_str, len + 1); /* We have something like __attribute__ ((target ("+fp+nosimd"))). It is easier to detect and handle it explicitly here rather than going @@ -19569,8 +19571,10 @@ aarch64_process_target_attr (tree args) } size_t len = strlen (TREE_STRING_POINTER (args)); - char *str_to_check = (char *) alloca (len + 1); - strcpy (str_to_check, TREE_STRING_POINTER (args)); + auto_vec<char, 32> buffer; + buffer.safe_grow (len + 1); + char *str_to_check = buffer.address (); + memcpy (str_to_check, TREE_STRING_POINTER (args), len + 1); if (len == 0) { |