re PR sanitizer/80348 (UBSAN: compile time crash in ubsan_instrument_division)

	PR sanitizer/80348
	* typeck.c (cp_build_binary_op): Use NULL_TREE instead of NULL.  Set
	ORIG_TYPE earlier and not only when shortening.

	* g++.dg/ubsan/div-by-zero-3.C: New test.

From-SVN: r249624

diff --git a/gcc/cp/ChangeLog b/gcc/cp/ChangeLog
index 36d86098a347e9ff728ff60cedaac0fb12d26a12..91f79258da5bf8d3f535b7ce4c99f0b4c80c9d67 100644 (file)
--- a/gcc/cp/ChangeLog
+++ b/gcc/cp/ChangeLog
@@ -11,6 +11,12 @@
        PR c++/80244 - ICE with attribute in template alias.
        * tree.c (strip_typedefs): Handle UNDERLYING_TYPE.
 
+       2017-04-10  Marek Polacek  <polacek@redhat.com>
+
+       PR sanitizer/80348
+       * typeck.c (cp_build_binary_op): Use NULL_TREE instead of NULL.  Set
+       ORIG_TYPE earlier and not only when shortening.
+
        2017-04-07  Marek Polacek  <polacek@redhat.com>
 
        PR sanitizer/80348

diff --git a/gcc/cp/typeck.c b/gcc/cp/typeck.c
index ebde9a8dd06a3b37362894552c613899f4778c55..0e27e53b360e56204f998021f846b5ecd8b206a4 100644 (file)
--- a/gcc/cp/typeck.c
+++ b/gcc/cp/typeck.c
@@ -4042,7 +4042,7 @@ cp_build_binary_op (location_t location,
 
   /* Data type in which the computation is to be performed.
      In the simplest cases this is the common type of the arguments.  */
-  tree result_type = NULL;
+  tree result_type = NULL_TREE;
 
   /* Nonzero means operands have already been type-converted
      in whatever way is necessary.
@@ -4058,7 +4058,6 @@ cp_build_binary_op (location_t location,
   tree final_type = 0;
 
   tree result, result_ovl;
-  tree orig_type = NULL;
 
   /* Nonzero if this is an operation like MIN or MAX which can
      safely be computed in short if both args are promoted shorts.
@@ -4090,7 +4089,7 @@ cp_build_binary_op (location_t location,
   bool doing_shift = false;
 
   /* Tree holding instrumentation expression.  */
-  tree instrument_expr = NULL;
+  tree instrument_expr = NULL_TREE;
 
   if (code == TRUTH_AND_EXPR || code == TRUTH_ANDIF_EXPR
       || code == TRUTH_OR_EXPR || code == TRUTH_ORIF_EXPR
@@ -4966,6 +4965,10 @@ cp_build_binary_op (location_t location,
       return tmp;
     }
 
+  /* Remember the original type; RESULT_TYPE might be changed later on
+     by shorten_binary_op.  */
+  tree orig_type = result_type;
+
   if (arithmetic_types_p)
     {
       bool first_complex = (code0 == COMPLEX_TYPE);
@@ -5062,7 +5065,6 @@ cp_build_binary_op (location_t location,
 
       if (shorten && none_complex)
        {
-         orig_type = result_type;
          final_type = result_type;
          result_type = shorten_binary_op (result_type, op0, op1,
                                           shorten == -1);
@@ -5142,13 +5144,10 @@ cp_build_binary_op (location_t location,
             original result_type.  */
          tree cop0 = op0;
          tree cop1 = op1;
-         if (orig_type != NULL_TREE)
-           {
-             if (TREE_TYPE (cop0) != orig_type)
-               cop0 = cp_convert (orig_type, op0, complain);
-             if (TREE_TYPE (cop1) != orig_type)
-               cop1 = cp_convert (orig_type, op1, complain);
-           }
+         if (TREE_TYPE (cop0) != orig_type)
+           cop0 = cp_convert (orig_type, op0, complain);
+         if (TREE_TYPE (cop1) != orig_type)
+           cop1 = cp_convert (orig_type, op1, complain);
          instrument_expr = ubsan_instrument_division (location, cop0, cop1);
        }
       else if (doing_shift && (flag_sanitize & SANITIZE_SHIFT))

diff --git a/gcc/testsuite/ChangeLog b/gcc/testsuite/ChangeLog
index 368b097a398d577a584ec2c1aff9c1c95d236329..af99d62d7783b0d5827830186b60b66d844d3e5e 100644 (file)
--- a/gcc/testsuite/ChangeLog
+++ b/gcc/testsuite/ChangeLog
@@ -9,6 +9,11 @@
        PR c++/80244 - ICE with attribute in template alias.
        * g++.dg/cpp0x/alias-decl-59.C: New test.
 
+       2017-04-10  Marek Polacek  <polacek@redhat.com>
+
+       PR sanitizer/80348
+       * g++.dg/ubsan/div-by-zero-3.C: New test.
+
        2017-04-07  Marek Polacek  <polacek@redhat.com>
 
        PR sanitizer/80348

diff --git a/gcc/testsuite/g++.dg/ubsan/div-by-zero-3.C b/gcc/testsuite/g++.dg/ubsan/div-by-zero-3.C
new file mode 100644 (file)
index 0000000..589dd25
--- /dev/null
+++ b/gcc/testsuite/g++.dg/ubsan/div-by-zero-3.C
@@ -0,0 +1,22 @@
+// PR sanitizer/80348
+// { dg-do compile }
+// { dg-options "-fsanitize=integer-divide-by-zero" }
+
+extern long long int i;
+void
+fn1 ()
+{
+  (0 >= 10253361740180 >= long (0 >= 0)) % i;
+}
+
+void
+fn2 ()
+{
+  0 / unsigned (!(0 - 3) >= (0 > 0));
+}
+
+void
+fn3 ()
+{
+  (0 < 0 >= (0 < 0 < 0)) % (unsigned (2) << 0);
+}