Fix use-after-free bug identified by the Address Sanitizer
authorGreg Fitzgerald <garious@gmail.com>
Wed, 18 Feb 2015 21:54:32 +0000 (21:54 +0000)
committerGreg Fitzgerald <garious@gmail.com>
Wed, 18 Feb 2015 21:54:32 +0000 (21:54 +0000)
atomContent's memory is freed at the end of the stack frame,
but it is referenced by the atom pushed into _definedAtoms.

Differential Revision: http://reviews.llvm.org/D7732

llvm-svn: 229749

lld/lib/ReaderWriter/PECOFF/ReaderCOFF.cpp

index 7374882..67177b7 100644 (file)
@@ -985,12 +985,10 @@ std::error_code FileCOFF::maybeCreateSXDataAtoms() {
   if (sxdata.empty())
     return std::error_code();
 
-  std::vector<uint8_t> atomContent =
-      *new (_alloc) std::vector<uint8_t>((size_t)sxdata.size());
   auto *atom = new (_alloc) COFFDefinedAtom(
       *this, "", ".sxdata", Atom::scopeTranslationUnit, DefinedAtom::typeData,
       false /*isComdat*/, DefinedAtom::permR__, DefinedAtom::mergeNo,
-      atomContent, _ordinal++);
+      sxdata, _ordinal++);
 
   const ulittle32_t *symbolIndex =
       reinterpret_cast<const ulittle32_t *>(sxdata.data());