public inbox for gcc-cvs@sourceware.org help / color / mirror / Atom feed
From: Maciej W. Rozycki <macro@gcc.gnu.org> To: gcc-cvs@gcc.gnu.org Subject: [gcc r12-6696] RISC-V: Fix use-after-free error in `parse_multiletter_ext' Date: Tue, 18 Jan 2022 19:39:34 +0000 (GMT) [thread overview] Message-ID: <20220118193934.DBFC53858D39@sourceware.org> (raw) https://gcc.gnu.org/g:dad495e30135904b0d0305eab8c0ce5f838440d4 commit r12-6696-gdad495e30135904b0d0305eab8c0ce5f838440d4 Author: Maciej W. Rozycki <macro@embecosm.com> Date: Tue Jan 18 19:39:13 2022 +0000 RISC-V: Fix use-after-free error in `parse_multiletter_ext' Avoid undefined arithmetic involving a pointer to a heap allocation that has been freed and move a problematic calculation ahead of the following call to `free' in `riscv_subset_list::parse_multiletter_ext', removing a compilation error: .../gcc/common/config/riscv/riscv-common.cc: In member function 'const char* riscv_subset_list::parse_multiletter_ext(const char*, const char*, const char*)': .../gcc/common/config/riscv/riscv-common.cc:905:27: error: pointer 'subset' used after 'void free(void*)' [-Werror=use-after-free] 905 | p += end_of_version - subset; | ~~~~~~~~~~~~~~~^~~~~~~~ .../gcc/common/config/riscv/riscv-common.cc:904:12: note: call to 'void free(void*)' here 904 | free (subset); | ~~~~~^~~~~~~~ cc1plus: all warnings being treated as errors make[2]: *** [Makefile:2428: riscv-common.o] Error 1 and a build regression from commit 671a283636de ("Add -Wuse-after-free [PR80532]."). gcc/ * common/config/riscv/riscv-common.cc (riscv_subset_list::parse_multiletter_ext): Move pointer arithmetic ahead of `free'. Diff: --- gcc/common/config/riscv/riscv-common.cc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gcc/common/config/riscv/riscv-common.cc b/gcc/common/config/riscv/riscv-common.cc index 004822bfe6c..25f56707d94 100644 --- a/gcc/common/config/riscv/riscv-common.cc +++ b/gcc/common/config/riscv/riscv-common.cc @@ -901,8 +901,8 @@ riscv_subset_list::parse_multiletter_ext (const char *p, } add (subset, major_version, minor_version, explicit_version_p, false); - free (subset); p += end_of_version - subset; + free (subset); if (*p != '\0' && *p != '_') {
reply other threads:[~2022-01-18 19:39 UTC|newest] Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20220118193934.DBFC53858D39@sourceware.org \ --to=macro@gcc.gnu.org \ --cc=gcc-cvs@gcc.gnu.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).