From: Xiretza <xiretza@xiretza.xyz>
Date: Mon, 15 Mar 2021 14:55:18 +0000 (+0100)
Subject: modtools: fix use-after-free of cell pointers in ModWalker
X-Git-Tag: yosys-0.10~242
X-Git-Url: https://git.libre-soc.org/?a=commitdiff_plain;h=3aa10e90ba1d57e4d01c199396a52fbd1a66fa7e;p=yosys.git

modtools: fix use-after-free of cell pointers in ModWalker

cell_inputs and cell_outputs retain cell pointers as their keys across
invocations of setup(), which may however be invalidated in the meantime
(as happens in e.g. passes/opt/share.cc:1432). A later rehash of the
dicts (caused by inserting in ModWalker::add_wire()) will cause them to
be dereferenced.
---

diff --git a/kernel/modtools.h b/kernel/modtools.h
index 29c510059..3af5367b1 100644
--- a/kernel/modtools.h
+++ b/kernel/modtools.h
@@ -395,6 +395,8 @@ struct ModWalker
 		signal_consumers.clear();
 		signal_inputs.clear();
 		signal_outputs.clear();
+		cell_inputs.clear();
+		cell_outputs.clear();
 
 		for (auto &it : module->wires_)
 			add_wire(it.second);