[PATCH] gcc/jit/jit-recording.cc: recording::global::write_to_dump: Avoid crashes when writing psuedo-C for globals with string initializers.

[PATCH] gcc/jit/jit-recording.cc: recording::global::write_to_dump: Avoid crashes when writing psuedo-C for globals with string initializers.

[Vibhav Pant]

[-- Attachment #1.1: Type: text/plain, Size: 1005 bytes --]

If a char * global was initialized with a rvalue from
`gcc_jit_context_new_string_literal` containing a format string,
dumping the context causes libgccjit to SIGSEGV due to an improperly
constructed call to vasprintf. The following code snippet can reproduce
the crash:

int main(int argc, char **argv)
{
 gcc_jit_context *ctxt = gcc_jit_context_acquire ();
 gcc_jit_lvalue *var = gcc_jit_context_new_global(
 ctxt, NULL, GCC_JIT_GLOBAL_EXPORTED,
 gcc_jit_context_get_type(ctxt, GCC_JIT_TYPE_CONST_CHAR_PTR),
 "var");
 gcc_jit_global_set_initializer_rvalue(
 var, gcc_jit_context_new_string_literal(ctxt, "%s"));
 gcc_jit_context_dump_to_file (ctxt, "output", 0);
 return 0;
}

The offending line is jit-recording.cc:4922, where a call to d.write
passes the initializer rvalue's debug string to `write` without a
format specifier. The attached patch fixes this issue.

Thanks,
Vibhav
-- 
Vibhav Pant
vibhavp@gmail.com
GPG: 7ED1 D48C 513C A024 BE3A 785F E3FB 28CB 6AB5 9598


[-- Attachment #1.2: 0001-jit-recording.cc-Dump-string-literal-initializers-co.patch --]
[-- Type: text/x-patch, Size: 756 bytes --]

From e598a4076b2bff72b4a3cc29d1d70db8c53baf45 Mon Sep 17 00:00:00 2001
From: Vibhav Pant <vibhavp@gmail.com>
Date: Fri, 25 Nov 2022 02:02:09 +0530
Subject: [PATCH] jit-recording.cc: Dump string literal initializers correctly

---
 gcc/jit/jit-recording.cc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/gcc/jit/jit-recording.cc b/gcc/jit/jit-recording.cc
index 6ae5a667e90..7bb98ddcb42 100644
--- a/gcc/jit/jit-recording.cc
+++ b/gcc/jit/jit-recording.cc
@@ -4919,7 +4919,7 @@ recording::global::write_to_dump (dump &d)
   else if (m_rvalue_init)
     {
       d.write (" = ");
-      d.write (m_rvalue_init->get_debug_string ());
+      d.write ("%s", m_rvalue_init->get_debug_string ());
       d.write (";\n");
     }
 
-- 
2.38.1


[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: [PATCH] gcc/jit/jit-recording.cc: recording::global::write_to_dump: Avoid crashes when writing psuedo-C for globals with string initializers.

[David Malcolm]

On Fri, 2022-11-25 at 02:13 +0530, Vibhav Pant via Jit wrote:
> If a char * global was initialized with a rvalue from
> `gcc_jit_context_new_string_literal` containing a format string,
> dumping the context causes libgccjit to SIGSEGV due to an improperly
> constructed call to vasprintf. The following code snippet can
> reproduce
> the crash:
> 
> int main(int argc, char **argv)
> {
>  gcc_jit_context *ctxt = gcc_jit_context_acquire ();
>  gcc_jit_lvalue *var = gcc_jit_context_new_global(
>  ctxt, NULL, GCC_JIT_GLOBAL_EXPORTED,
>  gcc_jit_context_get_type(ctxt, GCC_JIT_TYPE_CONST_CHAR_PTR),
>  "var");
>  gcc_jit_global_set_initializer_rvalue(
>  var, gcc_jit_context_new_string_literal(ctxt, "%s"));
>  gcc_jit_context_dump_to_file (ctxt, "output", 0);
>  return 0;
> }
> 
> The offending line is jit-recording.cc:4922, where a call to d.write
> passes the initializer rvalue's debug string to `write` without a
> format specifier. The attached patch fixes this issue.

Thanks for spotting this, and sorry about missing your patch.

I've gone ahead and pushed this to trunk (as r14-4923-gac66744d94226a),
and will backport it.

Dave