class.c (resort_type_method_vec): Avoid potential unsigned overflow.

	* class.c (resort_type_method_vec): Avoid potential unsigned
	overflow.

From-SVN: r249265

diff --git a/gcc/cp/ChangeLog b/gcc/cp/ChangeLog
index ff832f8f44d579316ecc5f44086e14c86a2bf1a8..2d7ee17689467f7f7be8f95ba9fedf9d8c038ddc 100644 (file)
--- a/gcc/cp/ChangeLog
+++ b/gcc/cp/ChangeLog
@@ -1,5 +1,8 @@
 2017-06-16  Nathan Sidwell  <nathan@acm.org>
 
+       * class.c (resort_type_method_vec): Avoid potential unsigned
+       overflow.
+
        Don't defer noexcept_deferred_spec.
        * cp-tree.h (unevaluated_noexcept_spec): Don't declare.
        * decl.c (cxx_init_decl_processing): Initialize

diff --git a/gcc/cp/class.c b/gcc/cp/class.c
index 054dd3e26e762be79b882e1943b6a9c249831280..1243f33605f367c5b42369a07242c34289923676 100644 (file)
--- a/gcc/cp/class.c
+++ b/gcc/cp/class.c
@@ -2328,25 +2328,25 @@ resort_type_method_vec (void* obj,
                        gt_pointer_operator new_value,
                        void* cookie)
 {
-  vec<tree, va_gc> *method_vec = (vec<tree, va_gc> *) obj;
-  int len = vec_safe_length (method_vec);
-  size_t slot;
-  tree fn;
+  if (vec<tree, va_gc> *method_vec = (vec<tree, va_gc> *) obj)
+    {
+      int len = method_vec->length ();
+      int slot;
 
-  /* The type conversion ops have to live at the front of the vec, so we
-     can't sort them.  */
-  for (slot = CLASSTYPE_FIRST_CONVERSION_SLOT;
-       vec_safe_iterate (method_vec, slot, &fn);
-       ++slot)
-    if (!DECL_CONV_FN_P (OVL_FIRST (fn)))
-      break;
+      /* The type conversion ops have to live at the front of the vec, so we
+        can't sort them.  */
+      for (slot = CLASSTYPE_FIRST_CONVERSION_SLOT;
+          slot < len; slot++)
+       if (!DECL_CONV_FN_P (OVL_FIRST ((*method_vec)[slot])))
+         break;
 
-  if (len - slot > 1)
-    {
-      resort_data.new_value = new_value;
-      resort_data.cookie = cookie;
-      qsort (method_vec->address () + slot, len - slot, sizeof (tree),
-            resort_method_name_cmp);
+      if (len > slot + 1)
+       {
+         resort_data.new_value = new_value;
+         resort_data.cookie = cookie;
+         qsort (method_vec->address () + slot, len - slot, sizeof (tree),
+                resort_method_name_cmp);
+       }
     }
 }