Skip to content

Commit 21a39df

Browse files
authored
[XRay][compiler-rt] Fix oob memory access in FDR BufferQueue iterator (#90940)
Before this change, the FDR BufferQueue iterator could access oob memory due to checks of the form `!Buffers[Offset].Used && Offset != Max`. This allows access to `Buffers[Max]`, which is past the end of the `Buffers` array. This can lead to crashes when that memory is not mapped. Fix this by testing `Offset != Max` first.
1 parent 1708de1 commit 21a39df

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

compiler-rt/lib/xray/xray_buffer_queue.h

+2-2
Original file line numberDiff line numberDiff line change
@@ -87,7 +87,7 @@ class BufferQueue {
8787
DCHECK_NE(Offset, Max);
8888
do {
8989
++Offset;
90-
} while (!Buffers[Offset].Used && Offset != Max);
90+
} while (Offset != Max && !Buffers[Offset].Used);
9191
return *this;
9292
}
9393

@@ -107,7 +107,7 @@ class BufferQueue {
107107
Max(M) {
108108
// We want to advance to the first Offset where the 'Used' property is
109109
// true, or to the end of the list/queue.
110-
while (!Buffers[Offset].Used && Offset != Max) {
110+
while (Offset != Max && !Buffers[Offset].Used) {
111111
++Offset;
112112
}
113113
}

0 commit comments

Comments
 (0)