From 66e9078f827383f77c1c239f6c09f2b07a963649 Mon Sep 17 00:00:00 2001 From: Steven Wu Date: Mon, 9 Sep 2024 14:12:12 -0700 Subject: [PATCH] [LTO] Fix a use-after-free in legacy LTO C APIs (#107896) Fix a bug that `lto_runtime_lib_symbols_list` is returning the address of a local variable that will be freed when getting out of scope. This is a regression from #98512 that rewrites the runtime libcall function lists into a SmallVector. rdar://135559037 --- llvm/tools/lto/lto.cpp | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/llvm/tools/lto/lto.cpp b/llvm/tools/lto/lto.cpp index d68cff839604f6..c8fbbd1e0b24b7 100644 --- a/llvm/tools/lto/lto.cpp +++ b/llvm/tools/lto/lto.cpp @@ -13,6 +13,7 @@ #include "llvm-c/lto.h" #include "llvm/ADT/STLExtras.h" +#include "llvm/ADT/SmallVector.h" #include "llvm/ADT/StringExtras.h" #include "llvm/Bitcode/BitcodeReader.h" #include "llvm/CodeGen/CommandFlags.h" @@ -88,6 +89,8 @@ struct LTOToolDiagnosticHandler : public DiagnosticHandler { } }; +static SmallVector RuntimeLibcallSymbols; + // Initialize the configured targets if they have not been initialized. static void lto_initialize() { if (!initialized) { @@ -108,6 +111,7 @@ static void lto_initialize() { LTOContext = &Context; LTOContext->setDiagnosticHandler( std::make_unique(), true); + RuntimeLibcallSymbols = lto::LTO::getRuntimeLibcallSymbols(Triple()); initialized = true; } } @@ -691,7 +695,6 @@ extern const char *lto_input_get_dependent_library(lto_input_t input, } extern const char *const *lto_runtime_lib_symbols_list(size_t *size) { - auto symbols = lto::LTO::getRuntimeLibcallSymbols(Triple()); - *size = symbols.size(); - return symbols.data(); + *size = RuntimeLibcallSymbols.size(); + return RuntimeLibcallSymbols.data(); }