diff options
author | Richard Biener <rguenther@suse.de> | 2021-05-12 09:07:42 +0200 |
---|---|---|
committer | Richard Biener <rguenther@suse.de> | 2021-05-12 10:47:59 +0200 |
commit | 229a6dbd9ef1680f1ca02d6ce63e8abdffaaeeba (patch) | |
tree | 594f0f1f8e93cf0840b6b86a84cead2e9865da56 | |
parent | 19040050aa2c8ee890fc58dda48639fc91bf0af0 (diff) | |
download | gcc-229a6dbd9ef1680f1ca02d6ce63e8abdffaaeeba.zip gcc-229a6dbd9ef1680f1ca02d6ce63e8abdffaaeeba.tar.gz gcc-229a6dbd9ef1680f1ca02d6ce63e8abdffaaeeba.tar.bz2 |
middle-end/100547 - check rtvec_alloc size
This makes the rtvec_alloc argument size_t catching overflow and
truncated arguments (from "invalid" testcases), verifying the
argument against INT_MAX which is the limit set by the int
typed rtvec_def.num_elem member.
2021-05-12 Richard Biener <rguenther@suse.de>
PR middle-end/100547
* rtl.h (rtvec_alloc): Make argument size_t.
* rtl.c (rtvec_alloc): Verify the count is less than INT_MAX.
-rw-r--r-- | gcc/rtl.c | 5 | ||||
-rw-r--r-- | gcc/rtl.h | 2 |
2 files changed, 5 insertions, 2 deletions
@@ -158,10 +158,13 @@ static size_t rtvec_alloc_sizes; Store the length, and initialize all elements to zero. */ rtvec -rtvec_alloc (int n) +rtvec_alloc (size_t n) { rtvec rt; + /* rtvec_def.num_elem is an int. */ + gcc_assert (n < INT_MAX); + rt = ggc_alloc_rtvec_sized (n); /* Clear out the vector. */ memset (&rt->elem[0], 0, n * sizeof (rtx)); @@ -2976,7 +2976,7 @@ extern rtx rtx_alloc_stat_v (RTX_CODE MEM_STAT_DECL, int); (sizeof (struct hwivec_def) \ + ((NWORDS)-1) * sizeof (HOST_WIDE_INT))) \ -extern rtvec rtvec_alloc (int); +extern rtvec rtvec_alloc (size_t); extern rtvec shallow_copy_rtvec (rtvec); extern bool shared_const_p (const_rtx); extern rtx copy_rtx (rtx); |