in-file function type derivation violates safety
Reported by
Nikodemus Siivola
on 2010-10-09
This bug affects 1 person
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| | SBCL |
High
|
Unassigned | ||
Bug Description
File-compiling the following and calling QUUX returns "foo" instead of signalling a type-error.
(declaim (optimize safety))
(defun foo ()
(cons t t))
(defun bar ()
(let ((cons (foo)))
(setf (car cons) 3)
cons))
(defun quux ()
(eval `(locally (declare (optimize safety))
(setf (fdefinition 'foo) (lambda () (copy-seq "foobar")))
(bar))))
Nikodemus Siivola (nikodemus)
on 2010-10-09
| Changed in sbcl: | |
| assignee: | nobody → Nikodemus Siivola (nikodemus) |
| status: | New → In Progress |
Nikodemus Siivola (nikodemus)
on 2010-10-10
| tags: | added: compiler types |
| Nikodemus Siivola (nikodemus) wrote : | #1 |
| Nikodemus Siivola (nikodemus) wrote : | #2 |
Attached patch is my current status on this. Pending addition of tests and more testing, I plan to commit this soonish.
The basic approach is to use ASSERT-LVAR-TYPE instead of DERIVE-NODE-TYPE for derived untrusted calls.
| Nikodemus Siivola (nikodemus) wrote : | #3 |
In 1.0.43.57.
Nikodemus Siivola (nikodemus)
on 2010-11-07
| Changed in sbcl: | |
| status: | Fix Committed → Fix Released |
To post a comment you must log in.
Marking this as "high" due to heap corruption potential.