The warning control falls into the C++ trap of using a reference
to old hashtable contents for a put operation which can end up
re-allocating that before reading from the old freed referenced to
source.  Fixed by introducing a temporary.

Bootstrap & regtest running on x86_64-unknown-linux-gnu.

2022-01-17  Richard Biener  <rguent...@suse.de>

        PR middle-end/101292
        * diagnostic-spec.c (copy_warning): Make sure to not
        reference old hashtable content on possible resize.
        * warning-control.cc (copy_warning): Likewise.
---
 gcc/diagnostic-spec.c  | 5 ++++-
 gcc/warning-control.cc | 3 ++-
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/gcc/diagnostic-spec.c b/gcc/diagnostic-spec.c
index a8af229d677..4341ccfaae9 100644
--- a/gcc/diagnostic-spec.c
+++ b/gcc/diagnostic-spec.c
@@ -195,7 +195,10 @@ copy_warning (location_t to, location_t from)
   else
     {
       if (from_spec)
-       nowarn_map->put (to, *from_spec);
+       {
+         nowarn_spec_t tem = *from_spec;
+         nowarn_map->put (to, tem);
+       }
       else
        nowarn_map->remove (to);
     }
diff --git a/gcc/warning-control.cc b/gcc/warning-control.cc
index f9808bf4392..fa39ecab421 100644
--- a/gcc/warning-control.cc
+++ b/gcc/warning-control.cc
@@ -206,7 +206,8 @@ void copy_warning (ToType to, FromType from)
          gcc_assert (supp);
 
          gcc_checking_assert (nowarn_map);
-         nowarn_map->put (to_loc, *from_spec);
+         nowarn_spec_t tem = *from_spec;
+         nowarn_map->put (to_loc, tem);
        }
       else
        {
-- 
2.31.1

Reply via email to