diff options
| author | StefanBruens <stefan.bruens@rwth-aachen.de> | 2020-12-22 03:23:42 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2020-12-22 03:23:42 +0100 |
| commit | 9396678db4f0e32192e73697c012d25432d602ca (patch) | |
| tree | 1d955725c8d8f80eb24deb21ceb9553586c609a2 /passes/opt | |
| parent | 3e67ab1ebb62a1cc69f2cb02546ae8b1cf838e07 (diff) | |
| download | yosys-9396678db4f0e32192e73697c012d25432d602ca.tar.gz yosys-9396678db4f0e32192e73697c012d25432d602ca.tar.bz2 yosys-9396678db4f0e32192e73697c012d25432d602ca.zip | |
Fix use-after-free in LUT opt pass
RTLIL::Module::remove(Cell* cell) calls `delete cell`.
Any subsequent accesses of `cell` then causes undefined behavior.
Diffstat (limited to 'passes/opt')
| -rw-r--r-- | passes/opt/opt_lut.cc | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/passes/opt/opt_lut.cc b/passes/opt/opt_lut.cc index 07a91af8a..623101016 100644 --- a/passes/opt/opt_lut.cc +++ b/passes/opt/opt_lut.cc @@ -277,12 +277,13 @@ struct OptLutWorker module->connect(lut_output, value); sigmap.add(lut_output, value); - module->remove(lut); luts.erase(lut); luts_arity.erase(lut); luts_dlogics.erase(lut); luts_dlogic_inputs.erase(lut); + module->remove(lut); + eliminated_count++; if (limit > 0) limit--; @@ -493,11 +494,12 @@ struct OptLutWorker luts_arity[lutM] = lutM_arity; luts.erase(lutR); luts_arity.erase(lutR); - lutR->module->remove(lutR); worklist.insert(lutM); worklist.erase(lutR); + lutR->module->remove(lutR); + combined_count++; if (limit > 0) limit--; |