From 9f63a8898154473f7b773c3e2ed71e4959719b71 Mon Sep 17 00:00:00 2001 From: Richard Biener Date: Fri, 24 Nov 2023 10:04:15 +0100 Subject: [PATCH] tree-optimization/112677 - stack corruption with .COND_* reduction The following makes sure to allocate enough space for vectype_op in vectorizable_reduction. PR tree-optimization/112677 * tree-vect-loop.cc (vectorizable_reduction): Use alloca to allocate vectype_op. --- gcc/tree-vect-loop.cc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gcc/tree-vect-loop.cc b/gcc/tree-vect-loop.cc index caaed977c89..3df020d2228 100644 --- a/gcc/tree-vect-loop.cc +++ b/gcc/tree-vect-loop.cc @@ -7385,7 +7385,6 @@ vectorizable_reduction (loop_vec_info loop_vinfo, stmt_vector_for_cost *cost_vec) { tree vectype_in = NULL_TREE; - tree vectype_op[3] = { NULL_TREE, NULL_TREE, NULL_TREE }; class loop *loop = LOOP_VINFO_LOOP (loop_vinfo); enum vect_def_type cond_reduc_dt = vect_unknown_def_type; stmt_vec_info cond_stmt_vinfo = NULL; @@ -7617,6 +7616,7 @@ vectorizable_reduction (loop_vec_info loop_vinfo, assumption is not true: we use reduc_index to record the index of the reduction variable. */ slp_tree *slp_op = XALLOCAVEC (slp_tree, op.num_ops); + tree *vectype_op = XALLOCAVEC (tree, op.num_ops); /* We need to skip an extra operand for COND_EXPRs with embedded comparison. */ unsigned opno_adjust = 0; -- 2.11.4.GIT