RPCS3/llvm-mirror
1
0
Fork 0
mirror of https://github.com/RPCS3/llvm-mirror.git synced 2024-10-19 19:12:56 +02:00
Code Issues Projects Releases Wiki Activity

Fix heap-use-after-free bug in expandSDiv when the operands are

Browse Source 
constants, as discovered by ASAN.

Patch by Mehdi Amini!

llvm-svn: 221401
This commit is contained in:
Michael Ilseman 2014-11-05 21:28:24 +00:00
parent aa5c69a514
commit f1932a5b9a
1 changed files with 10 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
lib/Transforms/Utils/IntegerDivision.cpp
View File

@ -398,11 +398,13 @@ bool llvm::expandRemainder(BinaryOperator *Rem) {
Rem->dropAllReferences();
Rem->eraseFromParent();
// If we didn't actually generate a udiv instruction, we're done
BinaryOperator *BO = dyn_cast<BinaryOperator>(Builder.GetInsertPoint());
if (!BO || BO->getOpcode() != Instruction::URem)
// If we didn't actually generate an urem instruction, we're done
// This happens for example if the input were constant. In this case the
// Builder insertion point was unchanged
if (Rem == Builder.GetInsertPoint())
return true;
BinaryOperator *BO = dyn_cast<BinaryOperator>(Builder.GetInsertPoint());
Rem = BO;
}
@ -456,11 +458,13 @@ bool llvm::expandDivision(BinaryOperator *Div) {
Div->dropAllReferences();
Div->eraseFromParent();
// If we didn't actually generate a udiv instruction, we're done
BinaryOperator *BO = dyn_cast<BinaryOperator>(Builder.GetInsertPoint());
if (!BO || BO->getOpcode() != Instruction::UDiv)
// If we didn't actually generate an udiv instruction, we're done
// This happens for example if the input were constant. In this case the
// Builder insertion point was unchanged
if (Div == Builder.GetInsertPoint())
return true;
BinaryOperator *BO = dyn_cast<BinaryOperator>(Builder.GetInsertPoint());
Div = BO;
}