[PATCH] D31066: COFF: Fix use-after-free in /msvclto implementation.

[Peter Collingbourne via Phabricator via llvm-commits]

pcc created this revision.

The Archive object owns the memory buffers of any thin archives, so we need
to make sure the object is still in scope when we access archive members.


https://reviews.llvm.org/D31066

Files:
  lld/COFF/Driver.cpp


Index: lld/COFF/Driver.cpp
===================================================================
--- lld/COFF/Driver.cpp
+++ lld/COFF/Driver.cpp
@@ -418,27 +418,21 @@
   return (OutFile.substr(0, OutFile.rfind('.')) + ".map").str();
 }
 
-// Returns slices of MB by parsing MB as an archive file.
-// Each slice consists of a member file in the archive.
-std::vector<MemoryBufferRef> getArchiveMembers(MemoryBufferRef MB) {
-  std::unique_ptr<Archive> File =
-      check(Archive::create(MB),
-            MB.getBufferIdentifier() + ": failed to parse archive");
-
+std::vector<MemoryBufferRef> getArchiveMembers(Archive *File) {
   std::vector<MemoryBufferRef> V;
   Error Err = Error::success();
   for (const ErrorOr<Archive::Child> &COrErr : File->children(Err)) {
     Archive::Child C =
-        check(COrErr, MB.getBufferIdentifier() +
-                          ": could not get the child of the archive");
+        check(COrErr,
+              File->getFileName() + ": could not get the child of the archive");
     MemoryBufferRef MBRef =
         check(C.getMemoryBufferRef(),
-              MB.getBufferIdentifier() +
+              File->getFileName() +
                   ": could not get the buffer for a child of the archive");
     V.push_back(MBRef);
   }
   if (Err)
-    fatal(MB.getBufferIdentifier() +
+    fatal(File->getFileName() +
           ": Archive::children failed: " + toString(std::move(Err)));
   return V;
 }
@@ -453,7 +447,7 @@
     return true;
 
   // Returns true if the archive contains at least one bitcode file.
-  for (MemoryBufferRef Member : getArchiveMembers(MB))
+  for (MemoryBufferRef Member : getArchiveMembers(File.get()))
     if (identify_magic(Member.getBuffer()) == file_magic::bitcode)
       return true;
   return false;
@@ -484,8 +478,12 @@
   log("Creating a temporary archive for " + Path +
       " to remove bitcode files");
 
+  std::unique_ptr<Archive> File =
+      check(Archive::create(MBRef),
+            MBRef.getBufferIdentifier() + ": failed to parse archive");
+
   std::vector<NewArchiveMember> New;
-  for (MemoryBufferRef Member : getArchiveMembers(MBRef))
+  for (MemoryBufferRef Member : getArchiveMembers(File.get()))
     if (identify_magic(Member.getBuffer()) != file_magic::bitcode)
       New.emplace_back(Member);
 


-------------- next part --------------
A non-text attachment was scrubbed...
Name: D31066.92097.patch
Type: text/x-patch
Size: 2299 bytes
Desc: not available
URL: <http://lists.llvm.org/pipermail/llvm-commits/attachments/20170317/f30f8951/attachment.bin>