diff options
| author | Jakub Ciolek <jakub@ciolek.dev> | 2025-11-19 11:17:47 +0100 |
|---|---|---|
| committer | Keith Randall <khr@golang.org> | 2025-11-21 10:34:21 -0800 |
| commit | f87aaec53d943eb2b5a6b9be9e4af284543c4004 (patch) | |
| tree | e09435d46390a6e3a6b5b67c9e2aebbb7cfd0723 /src/cmd | |
| parent | dbd2ab999262e1c9304d0591d6883f83b09c8570 (diff) | |
| download | go-f87aaec53d943eb2b5a6b9be9e4af284543c4004.tar.xz | |
cmd/compile: fix integer overflow in prove pass
The detectSliceLenRelation function incorrectly deduced lower bounds
for "len(s) - i" without checking if the subtraction could overflow
(e.g. when i is negative). This led to incorrect elimination of
bounds checks.
Fixes: #76355
Change-Id: I30ada0e5f1425929ddd8ae1b66e55096ec209b5b
Reviewed-on: https://go-review.googlesource.com/c/go/+/721920
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: David Chase <drchase@google.com>
Reviewed-by: Keith Randall <khr@google.com>
Diffstat (limited to 'src/cmd')
| -rw-r--r-- | src/cmd/compile/internal/ssa/prove.go | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/src/cmd/compile/internal/ssa/prove.go b/src/cmd/compile/internal/ssa/prove.go index d4e7ed14b1..4ffab848ba 100644 --- a/src/cmd/compile/internal/ssa/prove.go +++ b/src/cmd/compile/internal/ssa/prove.go @@ -2051,8 +2051,11 @@ func (ft *factsTable) detectSliceLenRelation(v *Value) { return } - slice := v.Args[0].Args[0] index := v.Args[1] + if !ft.isNonNegative(index) { + return + } + slice := v.Args[0].Args[0] for o := ft.orderings[index.ID]; o != nil; o = o.next { if o.d != signed { |