mirror of
https://github.com/nim-lang/Nim.git
synced 2025-12-29 01:14:41 +00:00
prevent use-after-free bugs in cased objects the bug happens specifically when deleting an item in a seq. The item taking it's place might not have the same case fields. Then =sink(x[i], move x[xl]) might leave the deleted fields still in memory! If the new item switches branches again, you get a use-after-free bug.
This commit is contained in:
@@ -165,9 +165,12 @@ proc fillBodyObj(c: var TLiftCtx; n, body, x, y: PNode; enforceDefaultOp: bool)
|
||||
# the value needs to be destroyed before we assign the selector
|
||||
# or the value is lost
|
||||
let prevKind = c.kind
|
||||
let prevAddMemReset = c.addMemReset
|
||||
c.kind = attachedDestructor
|
||||
c.addMemReset = true
|
||||
fillBodyObj(c, n, body, x, y, enforceDefaultOp = false)
|
||||
c.kind = prevKind
|
||||
c.addMemReset = prevAddMemReset
|
||||
localEnforceDefaultOp = true
|
||||
|
||||
if c.kind != attachedDestructor:
|
||||
|
||||
Reference in New Issue
Block a user