Use-after-free on invalid code with label

[efriedma-quic]

Bugzilla Link	4220
Resolution	FIXED
Resolved on	Feb 17, 2011 22:14
Version	unspecified
OS	Linux
Depends On	#3801

Extended Description

Testcase:

int a() { goto L; do { L:; } while 0; }

A use-after-free shows up running the testcase through "valgrind clang-cc".

[llvmbot]

this code doesn't compile

[efriedma-quic]

Yes, it doesn't compile; the point is the following:

==9687== Invalid read of size 4
==9687== at 0x8319838: clang::Sema::ActOnFinishFunctionBody(clang::OpaquePtr<0>, clang::ASTOwningResult<&(clang::ActionBase::DeleteStmt(void*))>, bool) (in /home/eli/llvmgbuild/Release/bin/clang-cc)
==9687== Address 0x4321854 is 12 bytes inside a block of size 20 free'd
==9687== at 0x4024B4A: free (vg_replace_malloc.c:323)
==9687== by 0x84B2376: clang::Stmt::DoDestroy(clang::ASTContext&) (in /home/eli/llvmgbuild/Release/bin/clang-cc)

[llvmbot]

This was probably caused by the label 'stitching' error recovery. Now that Stmt isn't memory managed, it probably won't show up in valgrind but the underlying issue that some analysis is done on dummy AST nodes is still present. The patch in #3801 should fix this by getting rid of the stitching hack.

[lattner]

This now valgrinds clean with the recent label rework that I landed. It is still (correctly) rejected with:

t2.c:1:36: error: expected '(' after 'do/while'
int a() { goto L; do { L:; } while 0; }
^

[lattner]

This now valgrinds clean with the recent label rework that I landed. It is still (correctly) rejected with:

t2.c:1:36: error: expected '(' after 'do/while'
int a() { goto L; do { L:; } while 0; }
^