[Bug c++/123920] asan error: dynamic-stack-buffer-overflow in eval_data_member_spec, reflect.cc since r16-6808-g4b0e94b394fa38

[jakub at gcc dot gnu.org via Gcc-bugs]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=123920

--- Comment #2 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Untested fix:

2026-02-02  Jakub Jelinek  <ja...@redhat.com>

        PR c++/123920
        * reflect.cc (eval_data_member_spec): Break out of the loop
        if value is integer_zerop even in the field
        && TREE_CODE (field) != RANGE_EXPR case and use a single
        test for integer_zerop (value) in the whole loop.

--- gcc/cp/reflect.cc.jj        2026-01-30 17:44:17.045951022 +0100
+++ gcc/cp/reflect.cc   2026-02-02 11:48:19.364444672 +0100
@@ -5703,10 +5703,10 @@ eval_data_member_spec (location_t loc, c
          memset (namep, 0, l + 1);
          l = 0;
          FOR_EACH_CONSTRUCTOR_ELT (CONSTRUCTOR_ELTS (f), k, field, value)
-           if (field == NULL_TREE)
+           if (integer_zerop (value))
+             break;
+           else if (field == NULL_TREE)
              {
-               if (integer_zerop (value))
-                 break;
                namep[l] = tree_to_shwi (value);
                ++l;
              }
@@ -5714,8 +5714,6 @@ eval_data_member_spec (location_t loc, c
              {
                tree lo = TREE_OPERAND (field, 0);
                tree hi = TREE_OPERAND (field, 1);
-               if (integer_zerop (value))
-                 break;
                unsigned HOST_WIDE_INT m = tree_to_uhwi (hi);
                for (l = tree_to_uhwi (lo); l <= m; ++l)
                  namep[l] = tree_to_shwi (value);