[compiler-rt] [sanitizer] avoid UB in allocator

[fmayer]

No description provided.

[llvmbot]

@llvm/pr-subscribers-compiler-rt-sanitizer

Author: Florian Mayer (fmayer)

Changes

---

Full diff: https://github.com/llvm/llvm-project/pull/126977.diff

1 Files Affected:

• (modified) compiler-rt/lib/sanitizer_common/sanitizer_allocator_local_cache.h (+4-1)

diff --git a/compiler-rt/lib/sanitizer_common/sanitizer_allocator_local_cache.h b/compiler-rt/lib/sanitizer_common/sanitizer_allocator_local_cache.h
index e495c56f03775..b67529fdeb5ff 100644
--- a/compiler-rt/lib/sanitizer_common/sanitizer_allocator_local_cache.h
+++ b/compiler-rt/lib/sanitizer_common/sanitizer_allocator_local_cache.h
@@ -166,7 +166,10 @@ struct SizeClassAllocator32LocalCache {
       DCHECK_GT(c->count, 0);
     }
     void *res = c->batch[--c->count];
-    PREFETCH(c->batch[c->count - 1]);
+    // By not doing pointer arithmetic, we avoid the OOB if c->count = 0.
+    // We just prefetch the previous member of the PerClass struct, which
+    // doesn't do harm.
+    PREFETCH(reinterpret_cast<uptr>(c->batch) + sizeof(c->batch[0])* (c->count - 1));
     stats_.Add(AllocatorStatAllocated, c->class_size);
     return res;
   }