Skip to content

Commit d684cb8

Browse files
authored
Fix a use-after-free crash in ResetObjCLayout (#170360)
operator[] can potentially cause reallocation and invalidate live iterators if it's called with a key that isn't present in the DenseMap. Call lookup() instead to prevent the function from inserting new entries into the DenseMap for ObjC classes that don't have any subclasses. rdar://165448332
1 parent 42bd2b5 commit d684cb8

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

clang/lib/AST/ASTContext.cpp

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12040,7 +12040,7 @@ bool ASTContext::mergeExtParameterInfo(
1204012040
void ASTContext::ResetObjCLayout(const ObjCInterfaceDecl *D) {
1204112041
if (auto It = ObjCLayouts.find(D); It != ObjCLayouts.end()) {
1204212042
It->second = nullptr;
12043-
for (auto *SubClass : ObjCSubClasses[D])
12043+
for (auto *SubClass : ObjCSubClasses.lookup(D))
1204412044
ResetObjCLayout(SubClass);
1204512045
}
1204612046
}

0 commit comments

Comments
 (0)