[llvm-branch-commits] [clang] [CodeGen] Fix -fsanitize=array-bounds for __sized_by / _or_null pointers (PR #213795)

[Usama Hameed via llvm-branch-commits]

================
@@ -1323,14 +1321,23 @@ void CodeGenFunction::EmitBoundsCheckImpl(const Expr *ArrayExpr,
   llvm::Value *IndexInst = Builder.CreateIntCast(IndexVal, Ty, IndexSigned);
   llvm::Value *BoundsInst = Builder.CreateIntCast(BoundsVal, Ty, false);
 
+  // For a '__sized_by' bound the loaded value is a byte count, so compare it
+  // against the index scaled to bytes: 'index * sizeof(element)'. The
+  // element-counting ('__counted_by') and plain-array cases pass a scale of 1.
+  // The value reported to the runtime handler stays the (unscaled) index.
+  llvm::Value *CheckIndex = IndexInst;
+  if (IndexScale > CharUnits::One())
+    CheckIndex = Builder.CreateMul(
----------------
usama54321 wrote:

This could overflow

https://github.com/llvm/llvm-project/pull/213795