Skip to content

Commit

Permalink
Fix stack-buffer-overflow in generated code
Browse files Browse the repository at this point in the history
When generating code for a local, we were using the LLVM type
for the allocation. However, we were assuming that the allocation
was sized according to the julia datatype size. These two sizes
do not match, as the julia size is rounded up to alignment,
causing a stack buffer overflow.
  • Loading branch information
Keno committed Aug 5, 2022
1 parent 01c0778 commit e21f674
Showing 1 changed file with 7 additions and 2 deletions.
9 changes: 7 additions & 2 deletions src/codegen.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -4341,7 +4341,7 @@ static jl_cgval_t emit_varinfo(jl_codectx_t &ctx, jl_varinfo_t &vi, jl_sym_t *va
}
else {
// copy value to a non-mutable (non-volatile SSA) location
AllocaInst *varslot = cast<AllocaInst>(vi.value.V);
AllocaInst *varslot = cast<AllocaInst>(vi.value.V->stripPointerCasts());
Type *T = varslot->getAllocatedType();
assert(!varslot->isArrayAllocation() && "variables not expected to be VLA");
AllocaInst *ssaslot = cast<AllocaInst>(varslot->clone());
Expand Down Expand Up @@ -7055,7 +7055,12 @@ static jl_llvm_functions_t
Type *vtype = julia_type_to_llvm(ctx, jt, &isboxed);
assert(!isboxed);
assert(!type_is_ghost(vtype) && "constants should already be handled");
Value *lv = new AllocaInst(vtype, M->getDataLayout().getAllocaAddrSpace(), jl_symbol_name(s), /*InsertBefore*/ctx.topalloca);
Type *alloc_type = ArrayType::get(getInt8Ty(ctx.builder.getContext()), jl_datatype_size(jt));
Value *lv = new AllocaInst(alloc_type, M->getDataLayout().getAllocaAddrSpace(), nullptr,
Align(jl_datatype_align(jt)), jl_symbol_name(s), /*InsertBefore*/ctx.topalloca);
#ifndef JL_LLVM_OPAQUE_POINTERS
lv = new BitCastInst(lv, PointerType::get(vtype, M->getDataLayout().getAllocaAddrSpace()), "", /*InsertBefore*/ctx.topalloca);
#endif
if (CountTrackedPointers(vtype).count) {
StoreInst *SI = new StoreInst(Constant::getNullValue(vtype), lv, false, Align(sizeof(void*)));
SI->insertAfter(ctx.topalloca);
Expand Down

0 comments on commit e21f674

Please sign in to comment.