[Ada] Memory corruption when using formal hashed sets or maps

Message ID 20190711080345.GA95233@adacore.com
State New
Headers show
Series
  • [Ada] Memory corruption when using formal hashed sets or maps
Related show

Commit Message

Pierre-Marie de Rodat July 11, 2019, 8:03 a.m.
Add a check to avoid causing a buffer overflow when the map is empty

Tested on x86_64-pc-linux-gnu, committed on trunk

2019-07-11  Claire Dross  <dross@adacore.com>

gcc/ada/

	* libgnat/a-cfhama.adb, libgnat/a-cfhase.adb (Free): Do not
	reset the Has_Element flag if no element is freed.

Patch

--- gcc/ada/libgnat/a-cfhama.adb
+++ gcc/ada/libgnat/a-cfhama.adb
@@ -509,8 +509,11 @@  is
 
    procedure Free (HT : in out Map; X : Count_Type) is
    begin
-      HT.Nodes (X).Has_Element := False;
-      HT_Ops.Free (HT, X);
+      if X /= 0 then
+         pragma Assert (X <= HT.Capacity);
+         HT.Nodes (X).Has_Element := False;
+         HT_Ops.Free (HT, X);
+      end if;
    end Free;
 
    ----------------------

--- gcc/ada/libgnat/a-cfhase.adb
+++ gcc/ada/libgnat/a-cfhase.adb
@@ -760,8 +760,11 @@  is
 
    procedure Free (HT : in out Set; X : Count_Type) is
    begin
-      HT.Nodes (X).Has_Element := False;
-      HT_Ops.Free (HT, X);
+      if X /= 0 then
+         pragma Assert (X <= HT.Capacity);
+         HT.Nodes (X).Has_Element := False;
+         HT_Ops.Free (HT, X);
+      end if;
    end Free;
 
    ----------------------