From: Nathan Sidwell <nathan@acm.org>
Date: Fri, 16 Jun 2017 14:49:35 +0000 (+0000)
Subject: class.c (resort_type_method_vec): Avoid potential unsigned overflow.
X-Git-Url: https://git.libre-soc.org/?a=commitdiff_plain;h=ba27a39d379b3ac69bd81944b65a99a0f02f240d;p=gcc.git

class.c (resort_type_method_vec): Avoid potential unsigned overflow.

	* class.c (resort_type_method_vec): Avoid potential unsigned
	overflow.

From-SVN: r249265
---

diff --git a/gcc/cp/ChangeLog b/gcc/cp/ChangeLog
index ff832f8f44d..2d7ee176894 100644
--- a/gcc/cp/ChangeLog
+++ b/gcc/cp/ChangeLog
@@ -1,5 +1,8 @@
 2017-06-16  Nathan Sidwell  <nathan@acm.org>
 
+	* class.c (resort_type_method_vec): Avoid potential unsigned
+	overflow.
+
 	Don't defer noexcept_deferred_spec.
 	* cp-tree.h (unevaluated_noexcept_spec): Don't declare.
 	* decl.c (cxx_init_decl_processing): Initialize
diff --git a/gcc/cp/class.c b/gcc/cp/class.c
index 054dd3e26e7..1243f33605f 100644
--- a/gcc/cp/class.c
+++ b/gcc/cp/class.c
@@ -2328,25 +2328,25 @@ resort_type_method_vec (void* obj,
 			gt_pointer_operator new_value,
 			void* cookie)
 {
-  vec<tree, va_gc> *method_vec = (vec<tree, va_gc> *) obj;
-  int len = vec_safe_length (method_vec);
-  size_t slot;
-  tree fn;
+  if (vec<tree, va_gc> *method_vec = (vec<tree, va_gc> *) obj)
+    {
+      int len = method_vec->length ();
+      int slot;
 
-  /* The type conversion ops have to live at the front of the vec, so we
-     can't sort them.  */
-  for (slot = CLASSTYPE_FIRST_CONVERSION_SLOT;
-       vec_safe_iterate (method_vec, slot, &fn);
-       ++slot)
-    if (!DECL_CONV_FN_P (OVL_FIRST (fn)))
-      break;
+      /* The type conversion ops have to live at the front of the vec, so we
+	 can't sort them.  */
+      for (slot = CLASSTYPE_FIRST_CONVERSION_SLOT;
+	   slot < len; slot++)
+	if (!DECL_CONV_FN_P (OVL_FIRST ((*method_vec)[slot])))
+	  break;
 
-  if (len - slot > 1)
-    {
-      resort_data.new_value = new_value;
-      resort_data.cookie = cookie;
-      qsort (method_vec->address () + slot, len - slot, sizeof (tree),
-	     resort_method_name_cmp);
+      if (len > slot + 1)
+	{
+	  resort_data.new_value = new_value;
+	  resort_data.cookie = cookie;
+	  qsort (method_vec->address () + slot, len - slot, sizeof (tree),
+		 resort_method_name_cmp);
+	}
     }
 }