[PATCH 05/20] builtin: Bound argument array iteration in declare_builtin()

[Bart Van Assche <bvanassche@acm.org>]

Bound the loop over entry->args[] in declare_builtin() with
ARRAY_SIZE(entry->args) before reading entry->args[i], and remove the
sentinel member _args_null_tail from struct builtin_fn.

Prevent out-of-bounds array reads past the end of struct builtin_fn's
six-element args[] array when declaring six-argument builtins such as
__atomic_compare_exchange_n, avoiding AddressSanitizer bounds errors.

Fixes: 935cf032524f ("builtin: use a table for the builtins")
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
 builtin.c | 2 +-
 builtin.h | 1 -
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/builtin.c b/builtin.c
index a704c5e8447c..1f3568bbad47 100644
--- a/builtin.c
+++ b/builtin.c
@@ -658,7 +658,7 @@ static void declare_builtin(int stream, const struct builtin_fn *entry)
 	fun->ctype.base_type = get_ctype(entry->ret_type);
 	fun->variadic = entry->variadic;
 
-	for (i = 0; (arg = entry->args[i]); i++) {
+	for (i = 0; i < ARRAY_SIZE(entry->args) && (arg = entry->args[i]); i++) {
 		struct symbol *anode = alloc_symbol(sym->pos, SYM_NODE);
 		anode->ctype.base_type = get_ctype(arg);
 		add_symbol(&fun->arguments, anode);
diff --git a/builtin.h b/builtin.h
index 5fe77c926244..8f82d138bec7 100644
--- a/builtin.h
+++ b/builtin.h
@@ -8,7 +8,6 @@ struct builtin_fn {
 	struct symbol *ret_type;
 	unsigned int variadic:1;
 	struct symbol *args[6];
-	struct symbol *_args_null_tail;
 	struct symbol_op *op;
 };