From: Vibhav Pant <vibhavp@gmail.com>
To: jit@gcc.gnu.org
Cc: gcc-patches@gcc.gnu.org
Subject: [PATCH] gcc/jit/jit-recording.cc: recording::global::write_to_dump: Avoid crashes when writing psuedo-C for globals with string initializers.
Date: Fri, 25 Nov 2022 02:13:34 +0530 [thread overview]
Message-ID: <5bcb69810185bfa4d614aef0c57fb4641b1ae2eb.camel@gmail.com> (raw)
[-- Attachment #1.1: Type: text/plain, Size: 1005 bytes --]
If a char * global was initialized with a rvalue from
`gcc_jit_context_new_string_literal` containing a format string,
dumping the context causes libgccjit to SIGSEGV due to an improperly
constructed call to vasprintf. The following code snippet can reproduce
the crash:
int main(int argc, char **argv)
{
gcc_jit_context *ctxt = gcc_jit_context_acquire ();
gcc_jit_lvalue *var = gcc_jit_context_new_global(
ctxt, NULL, GCC_JIT_GLOBAL_EXPORTED,
gcc_jit_context_get_type(ctxt, GCC_JIT_TYPE_CONST_CHAR_PTR),
"var");
gcc_jit_global_set_initializer_rvalue(
var, gcc_jit_context_new_string_literal(ctxt, "%s"));
gcc_jit_context_dump_to_file (ctxt, "output", 0);
return 0;
}
The offending line is jit-recording.cc:4922, where a call to d.write
passes the initializer rvalue's debug string to `write` without a
format specifier. The attached patch fixes this issue.
Thanks,
Vibhav
--
Vibhav Pant
vibhavp@gmail.com
GPG: 7ED1 D48C 513C A024 BE3A 785F E3FB 28CB 6AB5 9598
[-- Attachment #1.2: 0001-jit-recording.cc-Dump-string-literal-initializers-co.patch --]
[-- Type: text/x-patch, Size: 756 bytes --]
From e598a4076b2bff72b4a3cc29d1d70db8c53baf45 Mon Sep 17 00:00:00 2001
From: Vibhav Pant <vibhavp@gmail.com>
Date: Fri, 25 Nov 2022 02:02:09 +0530
Subject: [PATCH] jit-recording.cc: Dump string literal initializers correctly
---
gcc/jit/jit-recording.cc | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/gcc/jit/jit-recording.cc b/gcc/jit/jit-recording.cc
index 6ae5a667e90..7bb98ddcb42 100644
--- a/gcc/jit/jit-recording.cc
+++ b/gcc/jit/jit-recording.cc
@@ -4919,7 +4919,7 @@ recording::global::write_to_dump (dump &d)
else if (m_rvalue_init)
{
d.write (" = ");
- d.write (m_rvalue_init->get_debug_string ());
+ d.write ("%s", m_rvalue_init->get_debug_string ());
d.write (";\n");
}
--
2.38.1
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 488 bytes --]
next reply other threads:[~2022-11-24 20:43 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-11-24 20:43 Vibhav Pant [this message]
2023-10-25 12:40 ` David Malcolm
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=5bcb69810185bfa4d614aef0c57fb4641b1ae2eb.camel@gmail.com \
--to=vibhavp@gmail.com \
--cc=gcc-patches@gcc.gnu.org \
--cc=jit@gcc.gnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).