[CVE-2019-1426]

pleath · boingoing · commit fd5d5cf00475 · 2019-10-28T16:07:20.000-07:00
diff --git a/lib/Backend/GlobOptFields.cpp b/lib/Backend/GlobOptFields.cpp
@@ -250,7 +250,8 @@ GlobOpt::KillLiveElems(IR::IndirOpnd * indirOpnd, IR::Opnd * valueOpnd, BVSparse
             IR::RegOpnd *baseOpnd = indirOpnd->GetBaseOpnd();
             Value * baseValue = baseOpnd ? this->currentBlock->globOptData.FindValue(baseOpnd->m_sym) : nullptr;
             ValueInfo * baseValueInfo = baseValue ? baseValue->GetValueInfo() : nullptr;
-            if (!baseValueInfo || !baseValueInfo->IsNotNativeArray())
+            if (!baseValueInfo || !baseValueInfo->IsNotNativeArray() || 
+                (this->IsLoopPrePass() && !this->IsSafeToTransferInPrepass(baseOpnd->m_sym, baseValueInfo)))
             {
                 if (this->currentBlock->globOptData.maybeWrittenTypeSyms == nullptr)
                 {

Original file line number	Diff line number	Diff line change
`@@ -250,7 +250,8 @@ GlobOpt::KillLiveElems(IR::IndirOpnd * indirOpnd, IR::Opnd * valueOpnd, BVSparse`
`250`	`250`	`IR::RegOpnd *baseOpnd = indirOpnd->GetBaseOpnd();`
`251`	`251`	`Value * baseValue = baseOpnd ? this->currentBlock->globOptData.FindValue(baseOpnd->m_sym) : nullptr;`
`252`	`252`	`ValueInfo * baseValueInfo = baseValue ? baseValue->GetValueInfo() : nullptr;`
`253`		`- if (!baseValueInfo \|\| !baseValueInfo->IsNotNativeArray())`
	`253`	`+ if (!baseValueInfo \|\| !baseValueInfo->IsNotNativeArray() \|\|`
	`254`	`+ (this->IsLoopPrePass() && !this->IsSafeToTransferInPrepass(baseOpnd->m_sym, baseValueInfo)))`
`254`	`255`	`{`
`255`	`256`	`if (this->currentBlock->globOptData.maybeWrittenTypeSyms == nullptr)`
`256`	`257`	`{`