From bc40c5c68ff662fbdf8feffce9f17047053b0ebf Mon Sep 17 00:00:00 2001 From: Erich Keane Date: Tue, 9 Jan 2018 01:09:12 +0000 Subject: Fix use-after-free found by address-san on -r322028. r322028 attempted to remove something from the "Manglings" list when it was no longer valid, and did so with 'erase'. However, StringRefs to these were stored, so these became dangling references. This patch changes to using 'remove' instead of 'erase' to keep the strings valid. llvm-svn: 322052 --- clang/lib/CodeGen/CodeGenModule.cpp | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) (limited to 'clang/lib/CodeGen/CodeGenModule.cpp') diff --git a/clang/lib/CodeGen/CodeGenModule.cpp b/clang/lib/CodeGen/CodeGenModule.cpp index 85bd53741e1..32c9b28124a 100644 --- a/clang/lib/CodeGen/CodeGenModule.cpp +++ b/clang/lib/CodeGen/CodeGenModule.cpp @@ -813,7 +813,11 @@ void CodeGenModule::UpdateMultiVersionNames(GlobalDecl GD, // This is so that if the initial version was already the 'default' // version, we don't try to update it. if (OtherName != NonTargetName) { - Manglings.erase(NonTargetName); + // Remove instead of erase, since others may have stored the StringRef + // to this. + const auto ExistingRecord = Manglings.find(NonTargetName); + if (ExistingRecord != std::end(Manglings)) + Manglings.remove(&(*ExistingRecord)); auto Result = Manglings.insert(std::make_pair(OtherName, OtherGD)); MangledDeclNames[OtherGD.getCanonicalDecl()] = Result.first->first(); if (llvm::GlobalValue *Entry = GetGlobalValue(NonTargetName)) -- cgit v1.2.3