From c962a7692a3ff7ce939d5694bdf098b4e5ce27e6 Mon Sep 17 00:00:00 2001 From: Matt Liberty Date: Tue, 30 Jun 2026 23:27:18 +0000 Subject: [PATCH] Fix heap-use-after-free in PrimaDelayCalc copy constructor The copy constructor copied node_index_map_, a std::map. Copying the map reconstructs its red-black tree, which invokes the ParasiticNodeLess comparator and dereferences the ParasiticNode* keys. When a delay calculator is cloned for parallel delay calculation (GraphDelayCalc::findDelays -> FindVertexDelays -> ArcDelayCalc::copy), the source map can hold pointers to ParasiticNodes that were already freed because the net's parasitic network was rebuilt (e.g. during resizer repair). Dereferencing those freed keys is a heap-use-after-free. node_index_map_ is transient state: findNodeCount() clears and rebuilds it from the current parasitic network before any read, and the primary constructor leaves it default-constructed. Copying it is therefore both unnecessary and the sole source of the dangling-pointer dereference, so leave it default-constructed in the copy constructor as well. Signed-off-by: Matt Liberty --- dcalc/PrimaDelayCalc.cc | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/dcalc/PrimaDelayCalc.cc b/dcalc/PrimaDelayCalc.cc index 86456936f..871547973 100644 --- a/dcalc/PrimaDelayCalc.cc +++ b/dcalc/PrimaDelayCalc.cc @@ -65,7 +65,11 @@ PrimaDelayCalc::PrimaDelayCalc(StaState *sta) : PrimaDelayCalc::PrimaDelayCalc(const PrimaDelayCalc &dcalc) : DelayCalcBase(dcalc), pin_node_map_(network_), - node_index_map_(dcalc.node_index_map_), + // node_index_map_ is intentionally not copied. Its keys are raw + // ParasiticNode* whose pointees may already be freed when this copy is made + // (parasitic networks are rebuilt during repair), and copying the map would + // dereference them via the ParasiticNodeLess comparator. It is transient + // state rebuilt by findNodeCount() before any read. prima_order_(dcalc.prima_order_), watch_pin_values_(network_), table_dcalc_(makeDmpCeffElmoreDelayCalc(this))