From be6d8ffc107db78d0542b5ee2d3306e7e132725c Mon Sep 17 00:00:00 2001 From: Michael Matz Date: Mon, 15 Aug 2016 05:09:31 +0200 Subject: Fix access-after-free with statement expressions The return value of statement expressions might refer to local symbols, so those can't be popped. The old error message always was just a band-aid, and since disabling it for pointer types it wasn't effective anyway. It also never considered that also the vtop->sym member might have referred to such symbols (see the testcase with the local static, that used to segfault). For fixing this (can be seen better with valgrind and SYM_DEBUG) simply leave local symbols of stmt exprs on the stack. --- tcc.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'tcc.h') diff --git a/tcc.h b/tcc.h index f990f8f..e4b5a0e 100644 --- a/tcc.h +++ b/tcc.h @@ -1099,7 +1099,7 @@ ST_INLN void sym_free(Sym *sym); ST_FUNC Sym *sym_push2(Sym **ps, int v, int t, long c); ST_FUNC Sym *sym_find2(Sym *s, int v); ST_FUNC Sym *sym_push(int v, CType *type, int r, int c); -ST_FUNC void sym_pop(Sym **ptop, Sym *b); +ST_FUNC void sym_pop(Sym **ptop, Sym *b, int keep); ST_INLN Sym *struct_find(int v); ST_INLN Sym *sym_find(int v); ST_FUNC Sym *global_identifier_push(int v, int t, int c); -- cgit v1.3.1