isl_basic_set_opt: avoid invalid access on error path

[platform/upstream/isl.git] / isl_tab_pip.c

diff --git a/isl_tab_pip.c b/isl_tab_pip.c
index 4124f4b..7fb34c7 100644 (file)
--- a/isl_tab_pip.c
+++ b/isl_tab_pip.c
@@ -124,6 +124,8 @@ struct isl_context_lex {
  * "M" describes the solution in terms of the dimensions of "dom".
  * The number of columns of "M" is one more than the total number
  * of dimensions of "dom".
+ *
+ * If "M" is NULL, then there is no solution on "dom".
  */
 struct isl_partial_sol {
        int level;
@@ -322,11 +324,15 @@ static void sol_pop(struct isl_sol *sol)
                        isl_basic_set_free(partial->next->dom);
                        partial->next->dom = bset;
                        M = partial->next->M;
-                       M = isl_mat_drop_cols(M, M->n_col - n, n);
-                       partial->next->M = M;
+                       if (M) {
+                               M = isl_mat_drop_cols(M, M->n_col - n, n);
+                               partial->next->M = M;
+                               if (!M)
+                                       goto error;
+                       }
                        partial->next->level = sol->level;
 
-                       if (!bset || !M)
+                       if (!bset)
                                goto error;
 
                        sol->partial = partial->next;
@@ -2610,6 +2616,14 @@ error:
        return NULL;
 }
 
+/* Representation of the context when using generalized basis reduction.
+ *
+ * "shifted" contains the offsets of the unit hypercubes that lie inside the
+ * context.  Any rational point in "shifted" can therefore be rounded
+ * up to an integer point in the context.
+ * If the context is constrained by any equality, then "shifted" is not used
+ * as it would be empty.
+ */
 struct isl_context_gbr {
        struct isl_context context;
        struct isl_tab *tab;
@@ -2715,6 +2729,8 @@ static struct isl_basic_set *drop_constant_terms(struct isl_basic_set *bset)
 
 static int use_shifted(struct isl_context_gbr *cgbr)
 {
+       if (!cgbr->tab)
+               return 0;
        return cgbr->tab->bmap->n_eq == 0 && cgbr->tab->bmap->n_div == 0;
 }
 
@@ -2833,6 +2849,15 @@ error:
        return NULL;
 }
 
+/* Add the equality described by "eq" to the context.
+ * If "check" is set, then we check if the context is empty after
+ * adding the equality.
+ * If "update" is set, then we check if the samples are still valid.
+ *
+ * We do not explicitly add shifted copies of the equality to
+ * cgbr->shifted since they would conflict with each other.
+ * Instead, we directly mark cgbr->shifted empty.
+ */
 static void context_gbr_add_eq(struct isl_context *context, isl_int *eq,
                int check, int update)
 {
@@ -2840,6 +2865,11 @@ static void context_gbr_add_eq(struct isl_context *context, isl_int *eq,
 
        cgbr->tab = add_gbr_eq(cgbr->tab, eq);
 
+       if (cgbr->shifted && !cgbr->shifted->empty && use_shifted(cgbr)) {
+               if (isl_tab_mark_empty(cgbr->shifted) < 0)
+                       goto error;
+       }
+
        if (cgbr->cone && cgbr->cone->n_col != cgbr->cone->n_dead) {
                if (isl_tab_extend_cons(cgbr->cone, 2) < 0)
                        goto error;
@@ -3113,7 +3143,9 @@ static int context_gbr_detect_equalities(struct isl_context *context,
 
        n_ineq = cgbr->tab->bmap->n_ineq;
        cgbr->tab = isl_tab_detect_equalities(cgbr->tab, cgbr->cone);
-       if (cgbr->tab && cgbr->tab->bmap->n_ineq > n_ineq)
+       if (!cgbr->tab)
+               return -1;
+       if (cgbr->tab->bmap->n_ineq > n_ineq)
                propagate_equalities(cgbr, tab, n_ineq);
 
        return 0;
@@ -3190,6 +3222,9 @@ static void *context_gbr_save(struct isl_context *context)
        struct isl_context_gbr *cgbr = (struct isl_context_gbr *)context;
        struct isl_gbr_tab_undo *snap;
 
+       if (!cgbr->tab)
+               return NULL;
+
        snap = isl_alloc_type(cgbr->tab->mat->ctx, struct isl_gbr_tab_undo);
        if (!snap)
                return NULL;