riscv
/
yosys
mirror of https://github.com/YosysHQ/yosys.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Fix use-after-free in LUT opt pass 

RTLIL::Module::remove(Cell* cell) calls `delete cell`.

Any subsequent accesses of `cell` then causes undefined behavior.
This commit is contained in:
StefanBruens 2020-12-22 03:23:42 +01:00 committed by GitHub
parent 3e67ab1ebb
commit 9396678db4
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
passes/opt/opt_lut.cc
View File

@ -277,12 +277,13 @@ struct OptLutWorker
module->connect(lut_output, value);
sigmap.add(lut_output, value);
module->remove(lut);
luts.erase(lut);
luts_arity.erase(lut);
luts_dlogics.erase(lut);
luts_dlogic_inputs.erase(lut);
module->remove(lut);
eliminated_count++;
if (limit > 0)
limit--;
@ -493,11 +494,12 @@ struct OptLutWorker
luts_arity[lutM] = lutM_arity;
luts.erase(lutR);
luts_arity.erase(lutR);
lutR->module->remove(lutR);
worklist.insert(lutM);
worklist.erase(lutR);
lutR->module->remove(lutR);
combined_count++;
if (limit > 0)
limit--;