From be6d8ffc107db78d0542b5ee2d3306e7e132725c Mon Sep 17 00:00:00 2001 From: Michael Matz Date: Mon, 15 Aug 2016 05:09:31 +0200 Subject: Fix access-after-free with statement expressions The return value of statement expressions might refer to local symbols, so those can't be popped. The old error message always was just a band-aid, and since disabling it for pointer types it wasn't effective anyway. It also never considered that also the vtop->sym member might have referred to such symbols (see the testcase with the local static, that used to segfault). For fixing this (can be seen better with valgrind and SYM_DEBUG) simply leave local symbols of stmt exprs on the stack. --- libtcc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'libtcc.c') diff --git a/libtcc.c b/libtcc.c index dac4bb9..1346fa6 100644 --- a/libtcc.c +++ b/libtcc.c @@ -677,8 +677,8 @@ static int tcc_compile(TCCState *s1) s1->error_set_jmp_enabled = 0; free_inline_functions(s1); - sym_pop(&global_stack, NULL); - sym_pop(&local_stack, NULL); + sym_pop(&global_stack, NULL, 0); + sym_pop(&local_stack, NULL, 0); return s1->nb_errors != 0 ? -1 : 0; } -- cgit v1.3.1