JIT: Fix possible heap corruption in outlined composite SSA storage (#116132)

github-actions[bot] · jakobbotsch · web-flow · commit 0eb433a4a3e0 · 2025-06-09T10:59:52.000-05:00
Co-authored-by: Jakob Botsch Nielsen &lt;jakob.botsch.nielsen@gmail.com&gt;
diff --git a/src/coreclr/jit/gentree.cpp b/src/coreclr/jit/gentree.cpp
@@ -30167,7 +30167,7 @@ unsigned* SsaNumInfo::GetOutlinedNumSlot(Compiler* compiler, unsigned index) con
     // Copy over all of the already encoded numbers.
     if (!baseNum.IsInvalid())
     {
-        for (int i = 0; i < SIMPLE_NUM_COUNT; i++)
+        for (int i = 0; i < count; i++)
         {
             pFirstSlot[i] = baseNum.GetNum(compiler, i);
         }

Original file line number	Diff line number	Diff line change
`@@ -30167,7 +30167,7 @@ unsigned* SsaNumInfo::GetOutlinedNumSlot(Compiler* compiler, unsigned index) con`
`30167`	`30167`	`// Copy over all of the already encoded numbers.`
`30168`	`30168`	`if (!baseNum.IsInvalid())`
`30169`	`30169`	`{`
`30170`		`- for (int i = 0; i < SIMPLE_NUM_COUNT; i++)`
	`30170`	`+ for (int i = 0; i < count; i++)`
`30171`	`30171`	`{`
`30172`	`30172`	`pFirstSlot[i] = baseNum.GetNum(compiler, i);`
`30173`	`30173`	`}`