New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
stage2: implement ** and ++ at runtime #9876
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
In your crash screenshot, the Value object that has a bad memory reference is coming from a Decl's Value. Check the Decl name in a debugger and figure out why that Decl's Value is invalid.
I stubbed the case that causes the uaf out as a TODO for now as it is confusing me. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Can you please rebase this against master? I just pushed 3b2e25e which adds a missed copy() on the sentinel value and the element type.
Thanks for fixing the uaf! |
97641f8
to
71c902b
Compare
src/Sema.zig
Outdated
const alloc = try block.addTy(.alloc, ptr_ty); | ||
|
||
try sema.requireRuntimeBlock(block, lhs_src); | ||
if (mulinfo.len * mulinfo.elem_type.abiSize(sema.mod.getTarget()) <= 65535) { // if its less than the max integer size, we can bitcast it to an int |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This logic has to do with the limitations of the LLVM backend, specifically, right?
The AIR memset instruction is perfectly capable of representing any sized element. The LLVM backend can do this logic of checking for 65535, and the other backends can choose a different strategy for lowering the AIR instruction.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Well, the zig language requires that ints have bits <= 65535, so it may be because of llvm, but llvm is not the only reason, it's the zig spec.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Why integers? The element type of an array could be many other types besides integers
ptr_elem_ptr is a ty_pl, not bin_op also use usize instead of u64
Ok, marking as draft as memset with bitcast is being weird in llvm backend. |
30+ days old draft; closing. |
No description provided.