Skip to content

Commit 4527adc

Browse files
authored
Fix null pointer dereference in logging in mlir TransformOps (#92237)
A variable `typeConverterOp` may be nullptr after dynamic cast. There is a security guard for this, but during logging error message the variable getting dereferenced. Found with static analysis.
1 parent 28d5f79 commit 4527adc

File tree

1 file changed

+3
-2
lines changed

1 file changed

+3
-2
lines changed

mlir/lib/Dialect/Transform/IR/TransformOps.cpp

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -648,13 +648,14 @@ LogicalResult transform::ApplyConversionPatternsOp::verify() {
648648
if (!llvm::hasSingleElement(typeConverterRegion.front()))
649649
return emitOpError()
650650
<< "expected exactly one op in default type converter region";
651+
Operation *maybeTypeConverter = &typeConverterRegion.front().front();
651652
auto typeConverterOp = dyn_cast<transform::TypeConverterBuilderOpInterface>(
652-
&typeConverterRegion.front().front());
653+
maybeTypeConverter);
653654
if (!typeConverterOp) {
654655
InFlightDiagnostic diag = emitOpError()
655656
<< "expected default converter child op to "
656657
"implement TypeConverterBuilderOpInterface";
657-
diag.attachNote(typeConverterOp->getLoc()) << "op without interface";
658+
diag.attachNote(maybeTypeConverter->getLoc()) << "op without interface";
658659
return diag;
659660
}
660661
// Check default type converter type.

0 commit comments

Comments
 (0)