Re: [PATCH][ubsan] Add VLA bound instrumentation

[Jason Merrill <jason@redhat.com>]

On 10/31/2013 02:28 PM, Marek Polacek wrote:
>   	  /* A variable sized array.  */
>   	  itype = variable_size (itype);
> +
> +	  /* We need to stabilize side-effects in VLA sizes for regular array
> +	     declarations too, not just pointers to arrays.  */
> +	  stabilize_vla_size (itype);

Let's put this after the later call to variable_size, too.

>   	  if (TREE_CODE (itype) != SAVE_EXPR)
>   	    {
>   	      /* Look for SIZEOF_EXPRs in itype and fold them, otherwise
> @@ -8390,6 +8385,31 @@ compute_array_index_type (tree name, tre
>   	      if (found)
>   		itype = variable_size (fold (newitype));
>   	    }

i.e. here.

> +
> +	  if (cxx_dialect >= cxx1y)
> +	    {
> +	      /* If the VLA bound is larger than half the address space,
> +	         or less than zero, throw std::bad_array_length.  */
> +	      tree comp = build2 (LT_EXPR, boolean_type_node, itype,
> +				  ssize_int (-1));
> +	      comp = build3 (COND_EXPR, void_type_node, comp,
> +			     throw_bad_array_length (), void_zero_node);
> +	      finish_expr_stmt (comp);
> +	  }
> +
> +         if ((flag_sanitize & SANITIZE_VLA)
> +             /* From C++1y onwards, we throw an exception on a negative
> +                length size of an array; see above  */
> +             && cxx_dialect < cxx1y)

This could be

   else if (flag_sanitize & SANITIZE_VLA)

There's another use of stabilize_vla_size in grokdeclarator, that should 
be able to go as well.

Jason