isl_mat_variable_compression: fix use after free

[platform/upstream/isl.git] / isl_map.c

diff --git a/isl_map.c b/isl_map.c
index e05cc54..096fbc6 100644 (file)
--- a/isl_map.c
+++ b/isl_map.c
@@ -446,6 +446,7 @@ int isl_basic_map_alloc_equality(struct isl_basic_map *bmap)
                isl_seq_clr(bmap->eq[bmap->n_eq] +
                      1 + isl_basic_map_total_dim(bmap),
                      bmap->extra - bmap->n_div);
+       F_CLR(bmap, ISL_BASIC_MAP_NORMALIZED_DIVS);
        return bmap->n_eq++;
 }
 
@@ -497,6 +498,7 @@ void isl_basic_map_inequality_to_equality(
        bmap->n_ineq--;
        bmap->ineq++;
        F_CLR(bmap, ISL_BASIC_MAP_NORMALIZED);
+       F_CLR(bmap, ISL_BASIC_MAP_NORMALIZED_DIVS);
 }
 
 int isl_basic_map_alloc_inequality(struct isl_basic_map *bmap)
@@ -565,6 +567,7 @@ int isl_basic_map_alloc_div(struct isl_basic_map *bmap)
        isl_seq_clr(bmap->div[bmap->n_div] +
                      1 + 1 + isl_basic_map_total_dim(bmap),
                      bmap->extra - bmap->n_div);
+       F_CLR(bmap, ISL_BASIC_MAP_NORMALIZED_DIVS);
        return bmap->n_div++;
 }
 
@@ -1925,12 +1928,9 @@ struct isl_basic_set *isl_basic_map_underlying_set(
        bmap = isl_basic_map_cow(bmap);
        if (!bmap)
                goto error;
-       bmap->dim = isl_dim_cow(bmap->dim);
+       bmap->dim = isl_dim_underlying(bmap->dim, bmap->n_div);
        if (!bmap->dim)
                goto error;
-       bmap->dim->n_out += bmap->dim->nparam + bmap->dim->n_in + bmap->n_div;
-       bmap->dim->nparam = 0;
-       bmap->dim->n_in = 0;
        bmap->extra -= bmap->n_div;
        bmap->n_div = 0;
        bmap = isl_basic_map_finalize(bmap);
@@ -2066,11 +2066,13 @@ struct isl_set *isl_map_underlying_set(struct isl_map *map)
                        goto error;
        }
        if (map->n == 0)
-               map->dim->n_out += map->dim->nparam + map->dim->n_in;
-       else
-               map->dim->n_out = map->p[0]->dim->n_out;
-       map->dim->nparam = 0;
-       map->dim->n_in = 0;
+               map->dim = isl_dim_underlying(map->dim, 0);
+       else {
+               isl_dim_free(map->dim);
+               map->dim = isl_dim_copy(map->p[0]->dim);
+       }
+       if (!map->dim)
+               goto error;
        return (struct isl_set *)map;
 error:
        isl_map_free(map);