mirror/zig
1
0
Fork 0
mirror of https://github.com/ziglang/zig.git synced 2025-12-16 03:03:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #19374 from ziglang/slice-by-len-safety

Browse Source 
add OOB safety check for by-length slice of array
This commit is contained in:
Andrew Kelley 2024-03-21 01:47:54 -07:00 committed by GitHub
commit b5cef9e8b4
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 30 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
src/Sema.zig
View File

@ -33284,12 +33284,16 @@ fn analyzeSlice(
try sema.addSafetyCheck(block, src, is_non_null, .unwrap_null);
}
if (slice_ty.isSlice(mod)) {
const slice_len_inst = try block.addTyOp(.slice_len, Type.usize, ptr_or_slice);
const actual_len = if (slice_ty.sentinel(mod) == null)
slice_len_inst
else
try sema.analyzeArithmetic(block, .add, slice_len_inst, .one, src, end_src, end_src, true);
bounds_check: {
const actual_len = if (array_ty.zigTypeTag(mod) == .Array)
try mod.intRef(Type.usize, array_ty.arrayLenIncludingSentinel(mod))
else if (slice_ty.isSlice(mod)) l: {
const slice_len_inst = try block.addTyOp(.slice_len, Type.usize, ptr_or_slice);
break :l if (slice_ty.sentinel(mod) == null)
slice_len_inst
else
try sema.analyzeArithmetic(block, .add, slice_len_inst, .one, src, end_src, end_src, true);
} else break :bounds_check;
const actual_end = if (slice_sentinel != null)
try sema.analyzeArithmetic(block, .add, end, .one, src, end_src, end_src, true)

20
test/cases/safety/out of bounds array slice by length.zig Normal file
View File

@ -0,0 +1,20 @@
const std = @import("std");
pub fn panic(message: []const u8, stack_trace: ?*std.builtin.StackTrace, _: ?usize) noreturn {
_ = stack_trace;
if (std.mem.eql(u8, message, "index out of bounds: index 16, len 5")) {
std.process.exit(0);
}
std.process.exit(1);
}
pub fn main() !void {
var buf: [5]u8 = undefined;
_ = buf[foo(6)..][0..10];
return error.TestFailed;
}
fn foo(a: u32) u32 {
return a;
}
// run
// backend=llvm
// target=native