link: Coff, MachO, and Wasm all had the same UAF bug

1 files changed, 15 insertions, 8 deletions

diff --git a/src/link/Wasm.zig b/src/link/Wasm.zig
index f138cdc3e2..c51736ff28 100644
--- a/src/link/Wasm.zig
+++ b/src/link/Wasm.zig
@@ -1702,27 +1702,34 @@ pub fn getDeclVAddr(
     return target_symbol_index;
 }
 
-pub fn lowerAnonDecl(wasm: *Wasm, decl_val: InternPool.Index, decl_align: Alignment, src_loc: Module.SrcLoc) !codegen.Result {
+pub fn lowerAnonDecl(
+    wasm: *Wasm,
+    decl_val: InternPool.Index,
+    explicit_alignment: Alignment,
+    src_loc: Module.SrcLoc,
+) !codegen.Result {
     const gop = try wasm.anon_decls.getOrPut(wasm.base.allocator, decl_val);
     if (!gop.found_existing) {
         const mod = wasm.base.options.module.?;
         const ty = mod.intern_pool.typeOf(decl_val).toType();
         const tv: TypedValue = .{ .ty = ty, .val = decl_val.toValue() };
-        const name = try std.fmt.allocPrintZ(wasm.base.allocator, "__anon_{d}", .{@intFromEnum(decl_val)});
-        defer wasm.base.allocator.free(name);
+        var name_buf: [32]u8 = undefined;
+        const name = std.fmt.bufPrint(&name_buf, "__anon_{d}", .{
+            @intFromEnum(decl_val),
+        }) catch unreachable;
 
         switch (try wasm.lowerConst(name, tv, src_loc)) {
-            .ok => |atom_index| gop.value_ptr.* = atom_index,
+            .ok => |atom_index| wasm.anon_decls.values()[gop.index] = atom_index,
             .fail => |em| return .{ .fail = em },
         }
     }
 
-    const atom = wasm.getAtomPtr(gop.value_ptr.*);
+    const atom = wasm.getAtomPtr(wasm.anon_decls.values()[gop.index]);
     atom.alignment = switch (atom.alignment) {
-        .none => decl_align,
-        else => switch (decl_align) {
+        .none => explicit_alignment,
+        else => switch (explicit_alignment) {
             .none => atom.alignment,
-            else => atom.alignment.maxStrict(decl_align),
+            else => atom.alignment.maxStrict(explicit_alignment),
         },
     };
     return .ok;