Skip to content

Commit 1eb2a8b

Browse files
committed
Assert to insure that the worst-case glue-call arg count is not exceeded unless allowed to.
1 parent 1fa978e commit 1eb2a8b

File tree

1 file changed

+22
-5
lines changed

1 file changed

+22
-5
lines changed

src/boot/me/trans.ml

Lines changed: 22 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1244,7 +1244,7 @@ let trans_visitor
12441244
in
12451245
let callsz = Il.referent_ty_size word_bits self_args_rty in
12461246
let spill = new_fixup "forwarding fn spill" in
1247-
trans_glue_frame_entry callsz spill;
1247+
trans_glue_frame_entry callsz spill true;
12481248
let all_self_args_cell = caller_args_cell self_args_rty in
12491249
let self_indirect_args_cell =
12501250
get_element_ptr all_self_args_cell Abi.calltup_elt_indirect_args
@@ -1403,7 +1403,25 @@ let trans_visitor
14031403
and trans_glue_frame_entry
14041404
(callsz:size)
14051405
(spill:fixup)
1406+
(user_level:bool)
14061407
: unit =
1408+
(*
1409+
* The user_level flag is true to indicate that this is glue that is
1410+
* not called via the push/pop mechanism of trans_call_glue, and thereby
1411+
* may (legitimately) have callsz exceeding Abi.worst_case_glue_call_args.
1412+
*
1413+
* Assert that the callsz is indeed no bigger than our abi's purported
1414+
* worst-case glue args. Moreover, the callsz should be static for non-
1415+
* user-level glue, so we can rely on (force_sz callsz) as a preliminary
1416+
* assertion as well.
1417+
*)
1418+
if not user_level
1419+
then assert ((Int64.compare
1420+
(force_sz callsz)
1421+
(Int64.mul
1422+
word_sz
1423+
(Int64.of_int Abi.worst_case_glue_call_args))) <= 0);
1424+
14071425
let framesz = SIZE_fixup_mem_sz spill in
14081426
push_new_emitter_with_vregs None;
14091427
iflog (fun _ -> annotate "prologue");
@@ -1491,7 +1509,7 @@ let trans_visitor
14911509

14921510
let callsz = Il.referent_ty_size word_bits callee_args_rty in
14931511
let spill = new_fixup "bind glue spill" in
1494-
trans_glue_frame_entry callsz spill;
1512+
trans_glue_frame_entry callsz spill true;
14951513

14961514
let all_self_args_cell = caller_args_cell self_args_rty in
14971515

@@ -1545,9 +1563,8 @@ let trans_visitor
15451563
*)
15461564

15471565
and trans_mem_glue_frame_entry (n_outgoing_args:int) (spill:fixup) : unit =
1548-
let isz = cx.ctxt_abi.Abi.abi_implicit_args_sz in
1549-
let callsz = SIZE_fixed (Int64.add isz (word_n n_outgoing_args)) in
1550-
trans_glue_frame_entry callsz spill
1566+
let callsz = SIZE_fixed (word_n n_outgoing_args) in
1567+
trans_glue_frame_entry callsz spill false
15511568

15521569
and get_mem_glue (g:glue) (inner:Il.mem -> unit) : fixup =
15531570
match htab_search cx.ctxt_glue_code g with

0 commit comments

Comments
 (0)