cybercyst/go
1
0
Fork 0
mirror of https://github.com/golang/go.git synced 2025-05-05 15:43:04 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

cmd/compile: fix unsafe.Add with small-size offsets operands

Browse Source 
Like other builtin functions, unsafe.Add's len operand is allowed to
be variable sized. However, unlike other builtins, it doesn't get
lowered to a runtime function call, so we never end up coercing it to
a specific type. As a result, we could end up constructing an OpAddPtr
value but with a less-than-ptr-sized addend operand.

This CL fixes this by always coercing the second operand to uintptr
during SSA construction.

Theoretically, we could do this during walk instead, but the frontend
doesn't allow converting negative constants to uintptr.

Fixes #48536.

Change-Id: Ib0619ea79df58b256b250fec967a6d3c8afea631
Reviewed-on: https://go-review.googlesource.com/c/go/+/351592
Trust: Matthew Dempsky <mdempsky@google.com>
Run-TryBot: Matthew Dempsky <mdempsky@google.com>
TryBot-Result: Go Bot <gobot@golang.org>
Reviewed-by: Cuong Manh Le <cuong.manhle.vn@gmail.com>
This commit is contained in:
Matthew Dempsky 2021-09-22 15:56:58 -07:00
parent ee69b09424
commit 93453233bd
2 changed files with 34 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/cmd/compile/internal/ssagen/ssa.go
View File

@ -3206,6 +3206,11 @@ func (s *state) exprCheckPtr(n ir.Node, checkPtrOK bool) *ssa.Value {
n := n.(*ir.BinaryExpr)
ptr := s.expr(n.X)
len := s.expr(n.Y)
// Force len to uintptr to prevent misuse of garbage bits in the
// upper part of the register (#48536).
len = s.conv(n, len, len.Type, types.Types[types.TUINTPTR])
return s.newValue2(ssa.OpAddPtr, n.Type(), ptr, len)
default:

29
test/fixedbugs/issue48536.go Normal file
View File

@ -0,0 +1,29 @@
// run
// Copyright 2021 The Go Authors. All rights reserved.
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.
package main
import "unsafe"
var i = 257
func main() {
var buf [10]byte
p0 := unsafe.Pointer(&buf[0])
p1 := unsafe.Pointer(&buf[1])
if p := unsafe.Add(p0, uint8(i)); p != p1 {
println("FAIL:", p, "!=", p1)
}
var x uint8
if i != 0 {
x = 1
}
if p := unsafe.Add(p0, x); p != p1 {
println("FAIL:", p, "!=", p1)
}
}