Skip to content

SILOptimizer: avoid use-after-free with the name #20772

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Nov 27, 2018

Conversation

compnerd
Copy link
Member

On Windows at least, the std::string associated with the name of the
property would be copy constructed before being passed to the diagnostic
engine. The resultant DiagnosticArgument in the InFlightDiagnostic
would hold a StringRef to the copy-constructed std::string. However,
because the arguments are inalloca'ed on Windows, the copy constructed
string would be destructed before the return of the argument.
Fortunately, this would result in the standard library overwriting the
string and the use-after-free would fail to print the argument.
Explicitly construct the StringRef before passing the name to the
diagnostic to avoid the use-after-free.

Replace this paragraph with a description of your changes and rationale. Provide links to external references/discussions if appropriate.

Resolves SR-NNNN.

On Windows at least, the std::string associated with the name of the
property would be copy constructed before being passed to the diagnostic
engine.  The resultant DiagnosticArgument in the InFlightDiagnostic
would hold a StringRef to the copy-constructed std::string.  However,
because the arguments are inalloca'ed on Windows, the copy constructed
string would be destructed before the return of the argument.
Fortunately, this would result in the standard library overwriting the
string and the use-after-free would fail to print the argument.
Explicitly construct the StringRef before passing the name to the
diagnostic to avoid the use-after-free.
@compnerd
Copy link
Member Author

CC: @gottesmm

@compnerd
Copy link
Member Author

@swift-ci please test

@gottesmm
Copy link
Contributor

LGTM.

You seem to be finding a bunch of these. Is there a way we could statically define this away?

@compnerd
Copy link
Member Author

I tried to do some trickery with the template specialization, unfortunately, I couldn't find a way to actually do that due to the implicit conversion operator defined for std::string to StringRef. That is what is biting us. I think that we are just getting lucky on other targets.

@compnerd compnerd merged commit 4d9f8ba into swiftlang:master Nov 27, 2018
@compnerd compnerd deleted the diagnostics branch November 27, 2018 17:00
@jrose-apple
Copy link
Contributor

This can't possibly be the right fix. We pass std::strings to diagnostics all the time. If we're accidentally copying them, that's a problem with the diagnose wrapper, not with the call sites.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants