From aa3d804b725a8b4b4df6a23114ec6875693e7dea Mon Sep 17 00:00:00 2001 From: Lars-Peter Clausen Date: Sun, 31 May 2026 21:17:41 -0700 Subject: [PATCH] Fix out-of-bounds write for missing queue method arguments When a method argument is missing, the error path stores a nullptr in the argument vector for that missing slot. The vector was sized from the number of arguments that were present in the source, so calls such as `q.push_back()` or `q.insert(0)` wrote those nullptr placeholders past the end of the vector. Size the vector from the number of arguments required by the queue method instead. This gives the error path slots for the missing arguments while leaving valid calls unchanged. Signed-off-by: Lars-Peter Clausen --- elaborate.cc | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/elaborate.cc b/elaborate.cc index 03a9f4a18..ba327a815 100644 --- a/elaborate.cc +++ b/elaborate.cc @@ -4101,7 +4101,8 @@ NetProc* PCallTask::elaborate_queue_method_(Design*des, NetScope*scope, des->errors += 1; } ivl_type_t element_type = net->queue_type()->element_type(); - vectorargv (nparms+1); + unsigned expected_nparms = method_name == "insert" ? 2 : 1; + vectorargv (expected_nparms+1); argv[0] = sig; auto args = map_named_args(des, parm_names, parms_);