commit a1a230af2ea557ed7a9fcd9485ac16278dbdf778
Author: Frank Ch. Eigler <fche@redhat.com>
Date: Thu Oct 16 16:25:55 2014 -0400
RHBZ1153673: speculatively correct segv in dead_control_remover
It was reported that ::visit_block was occasionally called with
a 0-size input vs[]. That leads to an array overflow, as the
for condition becomes apprx. (i < UINT_MAX).
for (size_t i = 0; i < vs.size() - 1; ++i)
do_something_with (vs[i]);
Let's reject 0-size vectors right away.
diff --git a/elaborate.cxx b/elaborate.cxx
index fa90fe7..35109ab 100644
--- a/elaborate.cxx
+++ b/elaborate.cxx
@@ -4041,6 +4041,8 @@ struct dead_control_remover: public traversing_visitor
void dead_control_remover::visit_block (block* b)
{
vector<statement*>& vs = b->statements;
+ if (vs.size() == 0) /* else (size_t) size()-1 => very big */
+ return;
for (size_t i = 0; i < vs.size() - 1; ++i)
{
vs[i]->visit (this);