luke/verilator
1
0
Fork 0
mirror of https://github.com/verilator/verilator.git synced 2026-09-08 10:33:20 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix use-after-free of captured interface typedef in deleted generate branch (#8287)

Browse Source
This commit is contained in:
Nick Brereton
2026-09-04 14:27:11 -04:00
committed by GitHub
parent 18095ac924
commit b1c06fdb09
2 changed files with 26 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/V3Param.cpp
+1
View File
@@ -3269,6 +3269,7 @@ class ParamVisitor final : public VNVisitor {
} else {
nodep->unlinkFrBack();
}
V3LinkDotIfaceCapture::purgeDeletedSubtree(nodep);
VL_DO_DANGLING(nodep->deleteTree(), nodep);
// Normal edit rules will now recurse the replacement
} else {
test_regress/t/t_iface_typedef_capture_uaf.v
+25
View File
@@ -38,6 +38,22 @@ module avmm_autopipeline (
always_comb slave.req = internal_req;
endmodule
module genif_body #(
parameter bit ENABLE = 1
) (
avmm_if.slave master,
avmm_if.master slave
);
if (ENABLE) begin : gen_on
typedef master.request_t request_t;
request_t internal_req;
assign internal_req = master.req;
always_comb slave.req = internal_req;
end else begin : gen_off
always_comb slave.req = '0;
end
endmodule
module t;
for (genvar g = 0; g < 2; ++g) begin : gen_block
avmm_if #(.DW(32 * (g + 1))) m_if ();
@@ -48,8 +64,17 @@ module t;
);
end
avmm_if #(.DW(32)) on_m_if ();
avmm_if #(.DW(32)) on_s_if ();
avmm_if #(.DW(64)) off_m_if ();
avmm_if #(.DW(64)) off_s_if ();
// ENABLE=0 deletes the generate branch holding the captured typedef
genif_body #(.ENABLE(1)) body_on (.master(on_m_if), .slave(on_s_if));
genif_body #(.ENABLE(0)) body_off (.master(off_m_if), .slave(off_s_if));
initial begin
#1;
`checkd($bits(body_on.gen_on.internal_req), 33);
`checkd($bits(gen_block[0].pipe.internal_req), 33);
`checkd($bits(gen_block[1].pipe.internal_req), 65);
$write("*-* All Finished *-*\n");