procyberian/gcc
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix not caught use-after-scope with -O1 (PR sanitize/78106)

Browse source 
PR sanitizer/78106
	* sanopt.c (imm_dom_path_with_freeing_call): Handle gasm
	statements as they can also contain possibly a freeing call.
	PR sanitizer/78106
	* gcc.dg/asan/pr78106.c: New test.

From-SVN: r241511
This commit is contained in:
Martin Liska 2016-10-25 16:16:10 +02:00 • committed by Martin Liska
parent b93ee1bb06
commit 8e10495178
4 changed files with 47 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
gcc/ChangeLog
View file

@ -1,3 +1,9 @@
2016-10-25 Martin Liska <mliska@suse.cz>
PR sanitizer/78106
* sanopt.c (imm_dom_path_with_freeing_call): Handle gasm
statements as they can also contain possibly a freeing call.
2016-10-25 H.J. Lu <hongjiu.lu@intel.com>
Martin Liska <mliska@suse.cz>

6
gcc/sanopt.c
View file

@ -211,8 +211,12 @@ imm_dom_path_with_freeing_call (basic_block bb, basic_block dom)
for (gsi = gsi_start_bb (e->src); !gsi_end_p (gsi); gsi_next (&gsi))
{
gimple *stmt = gsi_stmt (gsi);
gasm *asm_stmt;
if (is_gimple_call (stmt) && !nonfreeing_call_p (stmt))
if ((is_gimple_call (stmt) && !nonfreeing_call_p (stmt))
|| ((asm_stmt = dyn_cast <gasm *> (stmt))
&& (gimple_asm_clobbers_memory_p (asm_stmt)
|| gimple_asm_volatile_p (asm_stmt))))
{
pred_info->has_freeing_call_p = true;
break;

5
gcc/testsuite/ChangeLog
View file

@ -1,3 +1,8 @@
2016-10-25 Martin Liska <mliska@suse.cz>
PR sanitizer/78106
* gcc.dg/asan/pr78106.c: New test.
2016-10-25 Martin Liska <mliska@suse.cz>
* gcc.dg/ipa/ipa-icf-32.c: Removed one scanned pattern.

31
gcc/testsuite/gcc.dg/asan/pr78106.c Normal file
View file

@ -0,0 +1,31 @@
/* PR sanitizer/78106 */
/* { dg-do compile } */
/* { dg-options "-fsanitize=address -fdump-tree-sanopt-details" } */
int *variable;
void __attribute__((used)) release()
{
__builtin_free (variable);
}
int main2(int argc)
{
*variable = 2;
if (argc <= 5)
asm volatile ("call release");
*variable = 2;
__builtin_abort ();
return 0;
}
int main(int argc, char **argv)
{
variable = __builtin_malloc (sizeof(int));
return main2(argc);
}
/* { dg-final { scan-tree-dump-not "Optimizing out(\n|\r\n|\r) ASAN_CHECK \\(7, variable.*" "sanopt" } } */