[Mesa-dev] [PATCH 2/2] st/clover: Use std::string for target IR string parameter

[Francisco Jerez]

Michel Dänzer <michel at daenzer.net> writes:

> From: Michel Dänzer <michel.daenzer at amd.com>
>
> That's what device::ir_target() returns. Fixes reading beyond allocated
> memory:
>
> ==1936== Invalid read of size 1
> ==1936==    at 0x4C2C1B4: strlen (vg_replace_strmem.c:412)
> ==1936==    by 0x9E00C30: std::basic_string<char, std::char_traits<char>, std::allocator<char> >::basic_string(char const*, std::allocator<char> const&) (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.20)
> ==1936==    by 0x5B44FAE: clover::compile_program_llvm(clover::compat::string const&, clover::compat::vector<clover::compat::pair<clover::compat::string, clover::compat::string> > const&, pipe_shader_ir, clover::compat::string const&, clover::compat::string const&, clover::compat::string&) (invocation.cpp:698)
> ==1936==    by 0x5B39A20: clover::program::build(clover::ref_vector<clover::device> const&, char const*, clover::compat::vector<clover::compat::pair<clover::compat::string, clover::compat::string> > const&) (program.cpp:63)
> ==1936==    by 0x5B20152: clBuildProgram (program.cpp:182)
> ==1936==    by 0x400F41: main (hello_world.c:109)
> ==1936==  Address 0x56fee1f is 0 bytes after a block of size 15 alloc'd
> ==1936==    at 0x4C28C20: malloc (vg_replace_malloc.c:296)
> ==1936==    by 0x5B398F0: alloc (compat.hpp:59)
> ==1936==    by 0x5B398F0: vector<std::basic_string<char> > (compat.hpp:98)
> ==1936==    by 0x5B398F0: string<std::basic_string<char> > (compat.hpp:327)
> ==1936==    by 0x5B398F0: clover::program::build(clover::ref_vector<clover::device> const&, char const*, clover::compat::vector<clover::compat::pair<clover::compat::string, clover::compat::string> > const&) (program.cpp:63)
> ==1936==    by 0x5B20152: clBuildProgram (program.cpp:182)
> ==1936==    by 0x400F41: main (hello_world.c:109)
>
> Signed-off-by: Michel Dänzer <michel.daenzer at amd.com>

Hi Michel, apparently the problem is this line:

| size_t processor_str_len = std::string(target.begin()).find_first_of("-");

That assumes that compat::string::begin() is null-terminated, which is
not necessarily the case.

Unfortunately I don't think we make that argument an std::string if we
still want to support building with LLVM < 3.5, since it may lead to ABI
issues.  Can you change the line to use the conversion operator instead
for the time being, like:

| size_t processor_str_len = std::string(target).find_first_of("-");

Thanks!

> ---
>  src/gallium/state_trackers/clover/core/compiler.hpp   | 2 +-
>  src/gallium/state_trackers/clover/llvm/invocation.cpp | 8 ++++----
>  2 files changed, 5 insertions(+), 5 deletions(-)
>
> diff --git a/src/gallium/state_trackers/clover/core/compiler.hpp b/src/gallium/state_trackers/clover/core/compiler.hpp
> index 7210d1e..21ef1e9 100644
> --- a/src/gallium/state_trackers/clover/core/compiler.hpp
> +++ b/src/gallium/state_trackers/clover/core/compiler.hpp
> @@ -35,7 +35,7 @@ namespace clover {
>     module compile_program_llvm(const compat::string &source,
>                                 const header_map &headers,
>                                 pipe_shader_ir ir,
> -                               const compat::string &target,
> +                               const std::string &target,
>                                 const compat::string &opts,
>                                 compat::string &r_log);
>  
> diff --git a/src/gallium/state_trackers/clover/llvm/invocation.cpp b/src/gallium/state_trackers/clover/llvm/invocation.cpp
> index 6cc07b2..5050345 100644
> --- a/src/gallium/state_trackers/clover/llvm/invocation.cpp
> +++ b/src/gallium/state_trackers/clover/llvm/invocation.cpp
> @@ -686,7 +686,7 @@ module
>  clover::compile_program_llvm(const compat::string &source,
>                               const header_map &headers,
>                               enum pipe_shader_ir ir,
> -                             const compat::string &target,
> +                             const std::string &target,
>                               const compat::string &opts,
>                               compat::string &r_log) {
>  
> @@ -695,9 +695,9 @@ clover::compile_program_llvm(const compat::string &source,
>                                                           debug_options, 0);
>  
>     std::vector<llvm::Function *> kernels;
> -   size_t processor_str_len = std::string(target.begin()).find_first_of("-");
> -   std::string processor(target.begin(), 0, processor_str_len);
> -   std::string triple(target.begin(), processor_str_len + 1,
> +   size_t processor_str_len = target.find_first_of("-");
> +   std::string processor(target.data(), 0, processor_str_len);
> +   std::string triple(target.data(), processor_str_len + 1,
>                        target.size() - processor_str_len - 1);
>     clang::LangAS::Map address_spaces;
>     llvm::LLVMContext llvm_ctx;
> -- 
> 2.1.4
>
> _______________________________________________
> mesa-dev mailing list
> mesa-dev at lists.freedesktop.org
> http://lists.freedesktop.org/mailman/listinfo/mesa-dev
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 212 bytes
Desc: not available
URL: <http://lists.freedesktop.org/archives/mesa-dev/attachments/20150122/9019f5c6/attachment.sig>