JIT: Fix possible heap corruption in outlined composite SSA storage (#116071)

jakobbotsch · web-flow · commit a8bc637b1076 · 2025-05-30T11:40:58.000+02:00
diff --git a/src/coreclr/jit/gentree.cpp b/src/coreclr/jit/gentree.cpp
@@ -31633,7 +31633,7 @@ unsigned* SsaNumInfo::GetOutlinedNumSlot(Compiler* compiler, unsigned index) con
     // Copy over all of the already encoded numbers.
     if (!baseNum.IsInvalid())
     {
-        for (int i = 0; i < SIMPLE_NUM_COUNT; i++)
+        for (int i = 0; i < count; i++)
         {
             pFirstSlot[i] = baseNum.GetNum(compiler, i);
         }

Original file line number	Diff line number	Diff line change
`@@ -31633,7 +31633,7 @@ unsigned* SsaNumInfo::GetOutlinedNumSlot(Compiler* compiler, unsigned index) con`
`31633`	`31633`	`// Copy over all of the already encoded numbers.`
`31634`	`31634`	`if (!baseNum.IsInvalid())`
`31635`	`31635`	`{`
`31636`		`- for (int i = 0; i < SIMPLE_NUM_COUNT; i++)`
	`31636`	`+ for (int i = 0; i < count; i++)`
`31637`	`31637`	`{`
`31638`	`31638`	`pFirstSlot[i] = baseNum.GetNum(compiler, i);`
`31639`	`31639`	`}`