Skip to content

Commit cb878ed

Browse files
YuriPlyakhingithub-actions[bot]
authored andcommitted
Automerge: [Frontend/Offloading] Fix use-after-reallocation in sycl::writeSymbolTable (#197612)
`writeSymbolTable` took raw pointers into the `SmallString` buffer (`Header`, `Entries`) and then called `Out.append()` / `Out.push_back()` inside the loop to write string data. When the `SmallString` needed to grow, it reallocated, silently invalidating those pointers. All writes through `Entries[I]` after the first reallocation were undefined behaviour; UBSAN caught this as a crash (exit code -6 / SIGABRT) on the sanitizer-x86_64-linux-bootstrap-ubsan builder. The fix pre-computes the total buffer size (header + entry array + all null-terminated name strings) and calls `reserve()` before any pointers are taken, guaranteeing that the subsequent `append` and `push_back` calls cannot trigger a reallocation.
2 parents 153ed2a + 02fa93f commit cb878ed

1 file changed

Lines changed: 6 additions & 2 deletions

File tree

llvm/lib/Frontend/Offloading/Utility.cpp

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -462,8 +462,12 @@ void sycl::writeSymbolTable(ArrayRef<StringRef> Names, SmallString<0> &Out) {
462462
uint32_t StringDataOffset =
463463
sizeof(SymbolTableHeader) + Count * sizeof(SymbolTableEntry);
464464

465-
// Pre-size the output to hold the header and entry array; string data is
466-
// appended below.
465+
// Compute total size and reserve to prevent reallocation while writing
466+
// entries via pointer (append() could otherwise invalidate the pointer).
467+
uint32_t TotalSize = StringDataOffset;
468+
for (StringRef N : Names)
469+
TotalSize += N.size() + 1;
470+
Out.reserve(TotalSize);
467471
Out.resize(StringDataOffset);
468472

469473
// Write the header.

0 commit comments

Comments
 (0)