Possible NULL dereference in mlir/Dialect/SPIRV/IR

[apach301]

Hi,

I found possible null pointer dereference with Svace static analyzer.

An intTy pointer is checked on NULL in mlir::spirv::ConstantOp::getAsmResultNames() at mlir/lib/Dialect/SPIRV/IR/SPIRVOps.cpp:726. But after that it is dereferenced without any checks:

llvm-project/mlir/lib/Dialect/SPIRV/IR/SPIRVOps.cpp

Lines 726 to 737 in b5a1747

	if (intTy && intTy.getWidth() == 1) {
	return setNameFn(getResult(), (intCst.getInt() ? "true" : "false"));
	}
	if (intTy.isSignless()) {
	specialName << intCst.getInt();
	} else if (intTy.isUnsigned()) {
	specialName << intCst.getUInt();
	} else {
	specialName << intCst.getSInt();
	}
	}

[llvmbot]

@llvm/issue-subscribers-mlir

Author: Daniel Kuts (apach301)

Hi,

I found possible null pointer dereference with Svace static analyzer.

An intTy pointer is checked on NULL in mlir::spirv::ConstantOp::getAsmResultNames() at mlir/lib/Dialect/SPIRV/IR/SPIRVOps.cpp:726. But after that it is dereferenced without any checks:

llvm-project/mlir/lib/Dialect/SPIRV/IR/SPIRVOps.cpp

Lines 726 to 737 in b5a1747

	if (intTy && intTy.getWidth() == 1) {
	return setNameFn(getResult(), (intCst.getInt() ? "true" : "false"));
	}
	if (intTy.isSignless()) {
	specialName << intCst.getInt();
	} else if (intTy.isUnsigned()) {
	specialName << intCst.getUInt();
	} else {
	specialName << intCst.getSInt();
	}
	}

[llvmbot]

@llvm/issue-subscribers-mlir-spirv

Author: Daniel Kuts (apach301)

Hi,

I found possible null pointer dereference with Svace static analyzer.

An intTy pointer is checked on NULL in mlir::spirv::ConstantOp::getAsmResultNames() at mlir/lib/Dialect/SPIRV/IR/SPIRVOps.cpp:726. But after that it is dereferenced without any checks:

llvm-project/mlir/lib/Dialect/SPIRV/IR/SPIRVOps.cpp

Lines 726 to 737 in b5a1747

	if (intTy && intTy.getWidth() == 1) {
	return setNameFn(getResult(), (intCst.getInt() ? "true" : "false"));
	}
	if (intTy.isSignless()) {
	specialName << intCst.getInt();
	} else if (intTy.isUnsigned()) {
	specialName << intCst.getUInt();
	} else {
	specialName << intCst.getSInt();
	}
	}

[kuhar]

There was no possible null dereference AFAICT, closing this as 'won't repro' / 'not planned' instead. Appreciate the code cleanup, though.