middle-end/101292 - invalid memory access with warning control

The warning control falls into the C++ trap of using a reference
to old hashtable contents for a put operation which can end up
re-allocating that before reading from the old freed referenced to
source.  Fixed by introducing a temporary.

2022-01-17  Richard Biener  <rguenther@suse.de>

	PR middle-end/101292
	* diagnostic-spec.c (copy_warning): Make sure to not
	reference old hashtable content on possible resize.
	* warning-control.cc (copy_warning): Likewise.

diff --git a/gcc/diagnostic-spec.c b/gcc/diagnostic-spec.c
index a8af229..4341ccf 100644 (file)
--- a/gcc/diagnostic-spec.c
+++ b/gcc/diagnostic-spec.c
@@ -195,7 +195,10 @@ copy_warning (location_t to, location_t from)
   else
     {
       if (from_spec)
-       nowarn_map->put (to, *from_spec);
+       {
+         nowarn_spec_t tem = *from_spec;
+         nowarn_map->put (to, tem);
+       }
       else
        nowarn_map->remove (to);
     }

diff --git a/gcc/warning-control.cc b/gcc/warning-control.cc
index f9808bf..fa39eca 100644 (file)
--- a/gcc/warning-control.cc
+++ b/gcc/warning-control.cc
@@ -206,7 +206,8 @@ void copy_warning (ToType to, FromType from)
          gcc_assert (supp);
 
          gcc_checking_assert (nowarn_map);
-         nowarn_map->put (to_loc, *from_spec);
+         nowarn_spec_t tem = *from_spec;
+         nowarn_map->put (to_loc, tem);
        }
       else
        {