[compiler-rt] r266288 - asan: fix out-of-bounds access in quarantine

[Dmitry Vyukov via llvm-commits]

Author: dvyukov
Date: Thu Apr 14 04:52:33 2016
New Revision: 266288

URL: http://llvm.org/viewvc/llvm-project?rev=266288&view=rev
Log:
asan: fix out-of-bounds access in quarantine


Modified:
    compiler-rt/trunk/lib/sanitizer_common/sanitizer_quarantine.h

Modified: compiler-rt/trunk/lib/sanitizer_common/sanitizer_quarantine.h
URL: http://llvm.org/viewvc/llvm-project/compiler-rt/trunk/lib/sanitizer_common/sanitizer_quarantine.h?rev=266288&r1=266287&r2=266288&view=diff
==============================================================================
--- compiler-rt/trunk/lib/sanitizer_common/sanitizer_quarantine.h (original)
+++ compiler-rt/trunk/lib/sanitizer_common/sanitizer_quarantine.h Thu Apr 14 04:52:33 2016
@@ -101,10 +101,12 @@ class Quarantine {
   void NOINLINE DoRecycle(Cache *c, Callback cb) {
     while (QuarantineBatch *b = c->DequeueBatch()) {
       const uptr kPrefetch = 16;
+      COMPILER_CHECK(kPrefetch <= ARRAY_SIZE(b->batch));
       for (uptr i = 0; i < kPrefetch; i++)
         PREFETCH(b->batch[i]);
-      for (uptr i = 0; i < b->count; i++) {
-        PREFETCH(b->batch[i + kPrefetch]);
+      for (uptr i = 0, count = b->count; i < count; i++) {
+        if (i + kPrefetch < count)
+          PREFETCH(b->batch[i + kPrefetch]);
         cb.Recycle((Node*)b->batch[i]);
       }
       cb.Deallocate(b);