luke
/
verilator
mirror of https://github.com/verilator/verilator.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Fix use after free in V3LinkDot (#6403)

This commit is contained in:
Geza Lore 2025-09-08 10:24:55 +01:00 committed by GitHub
parent e60f52ee0c
commit a1167b3d55
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 11 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
src/V3LinkDot.cpp
View File

@ -1517,26 +1517,19 @@ class LinkDotFindVisitor final : public VNVisitor {
&& !findvarp->subDTypep()->numeric().isSigned()) {
findvarp->subDTypep()->numeric(VSigning{true});
}
AstNodeDType* varDtp = findvarp->subDTypep();
AstNodeDType* otherDtp = nodep->subDTypep();
AstBasicDType* const bdtypep = VN_CAST(varDtp, BasicDType);
if (bdtypep && bdtypep->implicit()) {
AstNodeDType* const varDtp = findvarp->subDTypep();
AstNodeDType* const otherDtp = nodep->subDTypep();
if (varDtp
&& (VN_IS(varDtp, BasicDType)
&& VN_AS(varDtp, BasicDType)->implicit())) {
// Then have "input foo" and "real foo" so the
// dtype comes from the other side.
AstNodeDType* const newdtypep = otherDtp;
otherDtp = varDtp;
varDtp = newdtypep;
VL_DO_DANGLING(bdtypep->unlinkFrBack()->deleteTree(), bdtypep);
newdtypep->unlinkFrBack();
findvarp->childDTypep(newdtypep);
}
if (otherDtp && varDtp
&& !(VN_IS(otherDtp, BasicDType)
&& VN_AS(otherDtp, BasicDType)->keyword()
== VBasicDTypeKwd::LOGIC_IMPLICIT)
&& !(VN_IS(varDtp, BasicDType)
&& VN_AS(varDtp, BasicDType)->keyword()
== VBasicDTypeKwd::LOGIC_IMPLICIT)) {
VL_DO_DANGLING(varDtp->unlinkFrBack()->deleteTree(), varDtp);
findvarp->childDTypep(otherDtp->unlinkFrBack());
} else if (otherDtp && varDtp
&& !(VN_IS(otherDtp, BasicDType)
&& VN_AS(otherDtp, BasicDType)->implicit())) {
// otherDtp and varDtp both non-nullptr and neither are implicit
// Can't compare dtypes now as might contain parameters,
// defer to V3Width
AstAttrOf* const newp