mirrors/yosys
3
0
Fork 0
mirror of https://github.com/YosysHQ/yosys synced 2025-06-22 22:03:40 +00:00
Code Activity

Fix use-after-free in LUT opt pass

Browse source 
RTLIL::Module::remove(Cell* cell) calls `delete cell`.

Any subsequent accesses of `cell` then causes undefined behavior.
This commit is contained in:
StefanBruens 2020-12-22 03:23:42 +01:00 • committed by GitHub
parent 3e67ab1ebb
commit 9396678db4
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 4 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

6
passes/opt/opt_lut.cc
View file

@ -277,12 +277,13 @@ struct OptLutWorker
module->connect(lut_output, value); module->connect(lut_output, value);
sigmap.add(lut_output, value); sigmap.add(lut_output, value);
module->remove(lut);
luts.erase(lut); luts.erase(lut);
luts_arity.erase(lut); luts_arity.erase(lut);
luts_dlogics.erase(lut); luts_dlogics.erase(lut);
luts_dlogic_inputs.erase(lut); luts_dlogic_inputs.erase(lut);
module->remove(lut);
eliminated_count++; eliminated_count++;
if (limit > 0) if (limit > 0)
limit--; limit--;
@ -493,11 +494,12 @@ struct OptLutWorker
luts_arity[lutM] = lutM_arity; luts_arity[lutM] = lutM_arity;
luts.erase(lutR); luts.erase(lutR);
luts_arity.erase(lutR); luts_arity.erase(lutR);
lutR->module->remove(lutR);
worklist.insert(lutM); worklist.insert(lutM);
worklist.erase(lutR); worklist.erase(lutR);
lutR->module->remove(lutR);
combined_count++; combined_count++;
if (limit > 0) if (limit > 0)
limit--; limit--;