diff options
| author | Mitch Phillips <31459023+hctim@users.noreply.github.com> | 2022-06-16 14:27:38 -0700 |
|---|---|---|
| committer | Mitch Phillips <31459023+hctim@users.noreply.github.com> | 2022-06-16 14:47:27 -0700 |
| commit | ed5a349b89e9ccc1c3dbe427de27d28e145f8203 (patch) | |
| tree | db395f173b05c52e500a7963a492520161a0660b /llvm/lib/Object/COFFObjectFile.cpp | |
| parent | 72c1effb34aa9ae1994f6e1e6b6e6e67ef37b5c8 (diff) | |
| download | llvm-ed5a349b89e9ccc1c3dbe427de27d28e145f8203.zip llvm-ed5a349b89e9ccc1c3dbe427de27d28e145f8203.tar.gz llvm-ed5a349b89e9ccc1c3dbe427de27d28e145f8203.tar.bz2 | |
Make setSanitizerMetadata byval.
This fixes a UaF bug in llvm::GlobalObject::copyAttributesFrom, where a
sanitizer metadata object is captured by reference, and passed by
reference to llvm::GlobalValue::setSanitizerMetadata. The reference
comes from the same map that the new value is going to be inserted to,
and the map insertion triggers iterator invalidation - leading to a
use-after-free on the dangling reference.
This patch fixes that bug by making setSanitizerMetadata's argument
byval. This should also systematically prevent the problem from
happening in future, as it's a very easy pattern to have. This shouldn't
be any performance problem, the SanitizerMetadata struct is a bitfield
POD.
Diffstat (limited to 'llvm/lib/Object/COFFObjectFile.cpp')
0 files changed, 0 insertions, 0 deletions