Skip to content

Commit

Permalink
[flang][Lower] Fix use-after-free with TypeRange (#84369)
Browse files Browse the repository at this point in the history
TypeRange is an iterator range, it does not own storage spanned by the
iterators. When using TypeRange, make sure that the actual contents
don't "expire" while the range is in use.

This was detected by address sanitizer.
  • Loading branch information
kparzysz committed Mar 12, 2024
1 parent 0b2c24e commit 629afd4
Showing 1 changed file with 4 additions and 1 deletion.
5 changes: 4 additions & 1 deletion flang/lib/Lower/IO.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -242,8 +242,11 @@ static void makeNextConditionalOn(fir::FirOpBuilder &builder,
// is in a fir.iterate_while loop, the result must be propagated up to the
// loop scope as an extra ifOp result. (The propagation is done in genIoLoop.)
mlir::TypeRange resTy;
// TypeRange does not own its contents, so make sure the the type object
// is live until the end of the function.
mlir::IntegerType boolTy = builder.getI1Type();
if (inLoop)
resTy = builder.getI1Type();
resTy = boolTy;
auto ifOp = builder.create<fir::IfOp>(loc, resTy, ok,
/*withElseRegion=*/inLoop);
builder.setInsertionPointToStart(&ifOp.getThenRegion().front());
Expand Down

0 comments on commit 629afd4

Please sign in to comment.