mirror/v
1
0
Fork 0
mirror of https://github.com/vlang/v.git synced 2023-08-10 21:13:21 +03:00
Code Issues Projects Releases Wiki Activity

parser,gen: fix `arr << map[key] using map_get_and_set_1, leading to double free

Browse Source
This commit is contained in:
Delyan Angelov
2021-02-16 15:08:01 +02:00
parent 982e35909d
commit 843de10442
6 changed files with 70 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
vlib/v/gen/c/cgen.v
View File

@@ -4373,7 +4373,11 @@ fn (mut g Gen) index_expr(node ast.IndexExpr) {
g.is_array_set = true
g.write('map_set_1(')
} else {
g.write('(*(($elem_type_str*)map_get_and_set_1(')
if node.is_setter {
g.write('(*(($elem_type_str*)map_get_and_set_1(')
} else {
g.write('(*(($elem_type_str*)map_get_1(')
}
}
if !left_is_ptr || node.left_type.has_flag(.shared_f) {
g.write('&')
@@ -4409,7 +4413,11 @@ fn (mut g Gen) index_expr(node ast.IndexExpr) {
|| g.inside_map_index
|| (g.is_assign_lhs && !g.is_array_set && get_and_set_types) {
zero := g.type_default(info.value_type)
g.write('(*($elem_type_str*)map_get_and_set_1(')
if node.is_setter {
g.write('(*($elem_type_str*)map_get_and_set_1(')
} else {
g.write('(*($elem_type_str*)map_get_1(')
}
if !left_is_ptr {
g.write('&')
}