Mike Ash 7bb9579434 [Runtime] Fix copying in extended existential value witnesses. ...

Instead of copying the data and the type and witnesses separately, use the size in the value witness table and copy everything at once.

copyTypeInto assumed the type was an ordinary existential. When it was actually an extended existential, it would do an incorrect cast and read part of a pointer as the number of witness tables to copy. This would typically result in a large buffer overflow and crash. At this point we already know the type's size, so we can use that info directly rather than essentially recomputing it.

rdar://163980446

2025-11-07 23:38:09 -05:00

21 KiB

Raw Permalink Blame History

View Raw