On Fri, 2022-11-25 at 02:13 +0530, Vibhav Pant via Jit wrote:
> If a char * global was initialized with a rvalue from
> `gcc_jit_context_new_string_literal` containing a format string,
> dumping the context causes libgccjit to SIGSEGV due to an improperly
> constructed call to vasprintf. The following code snippet can
> reproduce
> the crash:
>
> int main(int argc, char **argv)
> {
> gcc_jit_context *ctxt = gcc_jit_context_acquire ();
> gcc_jit_lvalue *var = gcc_jit_context_new_global(
> ctxt, NULL, GCC_JIT_GLOBAL_EXPORTED,
> gcc_jit_context_get_type(ctxt, GCC_JIT_TYPE_CONST_CHAR_PTR),
> "var");
> gcc_jit_global_set_initializer_rvalue(
> var, gcc_jit_context_new_string_literal(ctxt, "%s"));
> gcc_jit_context_dump_to_file (ctxt, "output", 0);
> return 0;
> }
>
> The offending line is jit-recording.cc:4922, where a call to d.write
> passes the initializer rvalue's debug string to `write` without a
> format specifier. The attached patch fixes this issue.
Thanks for spotting this, and sorry about missing your patch.
I've gone ahead and pushed this to trunk (as r14-4923-gac66744d94226a),
and will backport it.
Dave
