From: Ted Kremenek <kremenek@apple.com>
Date: Wed, 5 Mar 2008 19:08:55 +0000 (+0000)
Subject: Fixed a horribly insidious bit-masking bug in the implementation of
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=596f0a1e54f610926e8bfded9efa1c639f824ded;p=clang

Fixed a horribly insidious bit-masking bug in the implementation of
ExplodedNode that would occasionally result in heap corruption.


git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@47956 91177308-0d34-0410-b5e6-96231b3b80d8
---

diff --git a/Analysis/ExplodedGraph.cpp b/Analysis/ExplodedGraph.cpp
index 69d190d09f..274565bf6c 100644
--- a/Analysis/ExplodedGraph.cpp
+++ b/Analysis/ExplodedGraph.cpp
@@ -23,18 +23,28 @@ static inline std::vector<ExplodedNodeImpl*>& getVector(void* P) {
 }
 
 void ExplodedNodeImpl::NodeGroup::addNode(ExplodedNodeImpl* N) {
+  
+  assert ((reinterpret_cast<uintptr_t>(N) & Mask) == 0x0);
+  
   if (getKind() == Size1) {
     if (ExplodedNodeImpl* NOld = getNode()) {
       std::vector<ExplodedNodeImpl*>* V = new std::vector<ExplodedNodeImpl*>();
+      assert ((reinterpret_cast<uintptr_t>(V) & Mask) == 0x0);
       V->push_back(NOld);
       V->push_back(N);
       P = reinterpret_cast<uintptr_t>(V) | SizeOther;
+      assert (getPtr() == (void*) V);
+      assert (getKind() == SizeOther);
     }
-    else
+    else {
       P = reinterpret_cast<uintptr_t>(N);
+      assert (getKind() == Size1);
+    }
   }
-  else
+  else {
+    assert (getKind() == SizeOther);
     getVector(getPtr()).push_back(N);
+  }
 }
 
 bool ExplodedNodeImpl::NodeGroup::empty() const {
@@ -62,7 +72,7 @@ ExplodedNodeImpl** ExplodedNodeImpl::NodeGroup::end() const {
   if (getKind() == Size1)
     return (ExplodedNodeImpl**) (P ? &P+1 : &P);
   else
-    return const_cast<ExplodedNodeImpl**>(&*(getVector(getPtr()).rbegin())+1);
+    return const_cast<ExplodedNodeImpl**>(&*(getVector(getPtr()).end()));
 }
 
 ExplodedNodeImpl::NodeGroup::~NodeGroup() {
diff --git a/include/clang/Analysis/PathSensitive/ExplodedGraph.h b/include/clang/Analysis/PathSensitive/ExplodedGraph.h
index ca76c48387..c1dc2224f8 100644
--- a/include/clang/Analysis/PathSensitive/ExplodedGraph.h
+++ b/include/clang/Analysis/PathSensitive/ExplodedGraph.h
@@ -51,7 +51,7 @@ protected:
     uintptr_t P;
     
     unsigned getKind() const {
-      return P & Mask;
+      return P & 0x1;
     }
     
     void* getPtr() const {