Skip to content

Commit bd7185b

Browse files
sorokinH. Peter Anvin
authored andcommitted
fix undefined behavior in count_mmac_params
When compiled -fsanitize=undefined nasm produced this error message: asm/preproc.c:2523:25: runtime error: member access within null pointer of type 'struct Token' The problem is reproducible on tests avx512f, avx512cd, avx512pf and avx512er in the test suite. The problematic line was: /* Advance to the next comma */ maybe_comma = &t->next; <<< HERE while (tok_isnt(t, ',')) { if (!tok_white(t)) comma = NULL; /* Non-empty parameter */ maybe_comma = &t->next; t = t->next; } When t is NULL this line doesn't cause memory access, but it is still an undefined behavior according to C standard. I believe that the underlying problem is that this loop doesn't have a sound invariant about maybe_comma: * On first iteration: *maybe_comma == t->next * On the following iterations: *maybe_comma == t I don't know what the intended loop invariant is and I decided to just mechanically fix the deferencing of NULL pointer, completely preserving the existing behavior. Signed-off-by: Ivan Sorokin <vanyacpp@gmail.com>
1 parent ad29725 commit bd7185b

File tree

1 file changed

+3
-0
lines changed

1 file changed

+3
-0
lines changed

asm/preproc.c

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2813,6 +2813,9 @@ static Token **count_mmac_params(Token *tline, int *nparamp, Token ***paramsp)
28132813
}
28142814
}
28152815

2816+
if (!t)
2817+
break; /* End of string, no comma */
2818+
28162819
/* Advance to the next comma */
28172820
maybe_comma = &t->next;
28182821
while (tok_isnt(t, ',')) {

0 commit comments

Comments
 (0)