[clang] db9549c - [clang][bytecode] Check builtin_memchr() for one-past-end pointers (#174187)

[via cfe-commits]

Author: Timm Baeder
Date: 2026-01-02T10:50:55+01:00
New Revision: db9549c4c0af41c990783a76f8a841d1499022e1

URL: https://github.com/llvm/llvm-project/commit/db9549c4c0af41c990783a76f8a841d1499022e1
DIFF: https://github.com/llvm/llvm-project/commit/db9549c4c0af41c990783a76f8a841d1499022e1.diff

LOG: [clang][bytecode] Check builtin_memchr() for one-past-end pointers (#174187)

We can't read from them and this fails later.

Fixes https://github.com/llvm/llvm-project/issues/173942

Added: 
    

Modified: 
    clang/lib/AST/ByteCode/InterpBuiltin.cpp
    clang/test/AST/ByteCode/builtin-functions.cpp

Removed: 
    


################################################################################
diff  --git a/clang/lib/AST/ByteCode/InterpBuiltin.cpp b/clang/lib/AST/ByteCode/InterpBuiltin.cpp
index 65101174247d1..065870c5c0ab5 100644
--- a/clang/lib/AST/ByteCode/InterpBuiltin.cpp
+++ b/clang/lib/AST/ByteCode/InterpBuiltin.cpp
@@ -73,6 +73,8 @@ static bool isReadable(const Pointer &P) {
     return false;
   if (!P.isLive())
     return false;
+  if (P.isOnePastEnd())
+    return false;
   return true;
 }
 
@@ -2089,6 +2091,9 @@ static bool interp__builtin_memchr(InterpState &S, CodePtr OpPC,
     return false;
   }
 
+  if (!isReadable(Ptr))
+    return false;
+
   if (ID == Builtin::BIstrchr || ID == Builtin::BI__builtin_strchr) {
     int64_t DesiredTrunc;
     if (S.getASTContext().CharTy->isSignedIntegerType())

diff  --git a/clang/test/AST/ByteCode/builtin-functions.cpp b/clang/test/AST/ByteCode/builtin-functions.cpp
index 3076b5239ebbe..3cde5a2b42e3d 100644
--- a/clang/test/AST/ByteCode/builtin-functions.cpp
+++ b/clang/test/AST/ByteCode/builtin-functions.cpp
@@ -1649,6 +1649,10 @@ namespace Memchr {
     return __builtin_char_memchr(c + 1, 'f', 1) == nullptr;
   }
   static_assert(f());
+
+
+  extern const char char_memchr_arg[0l];
+  char *memchr_result = __builtin_char_memchr(char_memchr_arg, 123, 32);
 }
 
 namespace Strchr {