Fix out of bound access

[xonotic/gmqcc.git] / ir.c

diff --git a/ir.c b/ir.c
index 08cedff0cdb7fc714ee6846f7eba7489dc5f590f..72e7406d663b9f570a90d890ee2e56257ca63d66 100644 (file)
--- a/ir.c
+++ b/ir.c
@@ -1800,14 +1800,33 @@ ir_value* ir_block_create_binop(ir_block *self, lex_ctx ctx,
             ot = TYPE_POINTER;
             break;
 #endif
             ot = TYPE_POINTER;
             break;
 #endif

+    /*
+     * after the following default case, the value of opcode can never
+     * be 1, 2, 3, 4, 5, 6, 7, 8, 9, 62, 63, 64, 65
+     */

         default:
             /* ranges: */
             /* boolean operations result in floats */
         default:
             /* ranges: */
             /* boolean operations result in floats */

+            
+            /*
+             * opcode >= 10 takes true branch opcode is at least 10
+             * opcode <= 23 takes false branch opcode is at least 24
+             */

             if (opcode >= INSTR_EQ_F && opcode <= INSTR_GT)
                 ot = TYPE_FLOAT;
             if (opcode >= INSTR_EQ_F && opcode <= INSTR_GT)
                 ot = TYPE_FLOAT;

+                
+            /* 
+             * At condition "opcode <= 23", the value of "opcode" must be 
+             * at least 24.
+             * At condition "opcode <= 23", the value of "opcode" cannot be
+             * equal to any of {1, 2, 3, 4, 5, 6, 7, 8, 9, 62, 63, 64, 65}.
+             * The condition "opcode <= 23" cannot be true.
+             * 
+             * Thus ot=2 (TYPE_FLOAT) can never be true
+             */
+#if 0

             else if (opcode >= INSTR_LE && opcode <= INSTR_GT)
                 ot = TYPE_FLOAT;
             else if (opcode >= INSTR_LE && opcode <= INSTR_GT)
                 ot = TYPE_FLOAT;

-#if 0

             else if (opcode >= INSTR_LE_I && opcode <= INSTR_EQ_FI)
                 ot = TYPE_FLOAT;
 #endif
             else if (opcode >= INSTR_LE_I && opcode <= INSTR_EQ_FI)
                 ot = TYPE_FLOAT;
 #endif


@@ -2605,7 +2624,7 @@ bool ir_function_calculate_liferanges(ir_function *self)
             if (v->memberof) {
                 ir_value *vec = v->memberof;
                 for (s = 0; s < vec_size(vec->reads); ++s) {
             if (v->memberof) {
                 ir_value *vec = v->memberof;
                 for (s = 0; s < vec_size(vec->reads); ++s) {

-                    if (vec->reads[s]->eid == v->life[0].end)
+                    if (vec->reads[s]->eid == vec->life[0].end)

                         break;
                 }
                 if (s < vec_size(vec->reads)) {
                         break;
                 }
                 if (s < vec_size(vec->reads)) {


@@ -3760,7 +3779,7 @@ void ir_function_dump(ir_function *f, char *ind,
         return;
     }
     oprintf("%sfunction %s\n", ind, f->name);
         return;
     }
     oprintf("%sfunction %s\n", ind, f->name);

-    strncat(ind, "\t", IND_BUFSZ);
+    strncat(ind, "\t", IND_BUFSZ-1);

     if (vec_size(f->locals))
     {
         oprintf("%s%i locals:\n", ind, (int)vec_size(f->locals));
     if (vec_size(f->locals))
     {
         oprintf("%s%i locals:\n", ind, (int)vec_size(f->locals));