Blob Blame History Raw
commit a1a230af2ea557ed7a9fcd9485ac16278dbdf778
Author: Frank Ch. Eigler <fche@redhat.com>
Date:   Thu Oct 16 16:25:55 2014 -0400

    RHBZ1153673: speculatively correct segv in dead_control_remover
    
    It was reported that ::visit_block was occasionally called with
    a 0-size input vs[].  That leads to an array overflow, as the
    for condition becomes apprx. (i < UINT_MAX).
    
       for (size_t i = 0; i < vs.size() - 1; ++i)
         do_something_with (vs[i]);
    
    Let's reject 0-size vectors right away.

diff --git a/elaborate.cxx b/elaborate.cxx
index fa90fe7..35109ab 100644
--- a/elaborate.cxx
+++ b/elaborate.cxx
@@ -4041,6 +4041,8 @@ struct dead_control_remover: public traversing_visitor
 void dead_control_remover::visit_block (block* b)
 {
   vector<statement*>& vs = b->statements;
+  if (vs.size() == 0) /* else (size_t) size()-1 => very big */
+    return;
   for (size_t i = 0; i < vs.size() - 1; ++i)
     {
       vs[i]->visit (this);