diff options
| author | Jakub Jelinek <jakub@redhat.com> | 2021-01-22 19:03:23 +0100 |
|---|---|---|
| committer | Jakub Jelinek <jakub@redhat.com> | 2021-01-22 19:04:55 +0100 |
| commit | a9ed18295bfc6d69d40af197e059e16622cd94c6 (patch) | |
| tree | 53b7bf20b4ae710c6154de2330c0d2a76a65d612 /gcc/cp/typeck2.c | |
| parent | 25fc4d01a8ed1888e6a65597a3387349eb3c950c (diff) | |
| download | gcc-a9ed18295bfc6d69d40af197e059e16622cd94c6.zip gcc-a9ed18295bfc6d69d40af197e059e16622cd94c6.tar.gz gcc-a9ed18295bfc6d69d40af197e059e16622cd94c6.tar.bz2 | |
c++: Fix up ubsan false positives on references [PR95693]
Alex' 2 years old change to build_zero_init_1 to return NULL pointer with
reference type for references breaks the sanitizers, the assignment of NULL
to a reference typed member is then instrumented before it is overwritten
with a non-NULL address later on.
That change has been done to fix error recovery ICE during
process_init_constructor_record, where we:
if (TYPE_REF_P (fldtype))
{
if (complain & tf_error)
error ("member %qD is uninitialized reference", field);
else
return PICFLAG_ERRONEOUS;
}
a few lines earlier, but then continue and ICE when build_zero_init returns
NULL.
The following patch reverts the build_zero_init_1 change and instead creates
the NULL with reference type constants during the error recovery.
The pr84593.C testcase Alex' change was fixing still works as before.
2021-01-22 Jakub Jelinek <jakub@redhat.com>
PR sanitizer/95693
* init.c (build_zero_init_1): Revert the 2018-03-06 change to
return build_zero_cst for reference types.
* typeck2.c (process_init_constructor_record): Instead call
build_zero_cst here during error recovery instead of build_zero_init.
* g++.dg/ubsan/pr95693.C: New test.
Diffstat (limited to 'gcc/cp/typeck2.c')
| -rw-r--r-- | gcc/cp/typeck2.c | 12 |
1 files changed, 8 insertions, 4 deletions
diff --git a/gcc/cp/typeck2.c b/gcc/cp/typeck2.c index d936250..f4be72f 100644 --- a/gcc/cp/typeck2.c +++ b/gcc/cp/typeck2.c @@ -1609,10 +1609,14 @@ process_init_constructor_record (tree type, tree init, int nested, int flags, warning (OPT_Wmissing_field_initializers, "missing initializer for member %qD", field); - if (!zero_init_p (fldtype) - || skipped < 0) - next = build_zero_init (fldtype, /*nelts=*/NULL_TREE, - /*static_storage_p=*/false); + if (!zero_init_p (fldtype) || skipped < 0) + { + if (TYPE_REF_P (fldtype)) + next = build_zero_cst (fldtype); + else + next = build_zero_init (fldtype, /*nelts=*/NULL_TREE, + /*static_storage_p=*/false); + } else { /* The default zero-initialization is fine for us; don't |