reflect: make Value.Pointer panic on bad notinheap pointers

Same as CL 350153 did for Value.Elem to panic on bad notinheap pointers.
While at it, also add more tests for notinheap deref.

Change-Id: Id7d9d12ad8467de5926b6a7e8f9d659fea5fedb5
Reviewed-on: https://go-review.googlesource.com/c/go/+/357630
Trust: Cuong Manh Le <cuong.manhle.vn@gmail.com>
Run-TryBot: Cuong Manh Le <cuong.manhle.vn@gmail.com>
TryBot-Result: Go Bot <gobot@golang.org>
Reviewed-by: Keith Randall <khr@golang.org>

diff --git a/src/reflect/all_test.go b/src/reflect/all_test.go
index fcd0e15f0a1c4170dcdd63dd40510d18830b5cb1..922998125b8fa4d8873e4196f6e6bf4e512cee75 100644 (file)
--- a/src/reflect/all_test.go
+++ b/src/reflect/all_test.go
@@ -7721,6 +7721,8 @@ func TestNotInHeapDeref(t *testing.T) {
 
        v = ValueOf((*nih)(unsafe.Pointer(new(int))))
        shouldPanic("reflect: reflect.Value.Elem on an invalid notinheap pointer", func() { v.Elem() })
+       shouldPanic("reflect: reflect.Value.Pointer on an invalid notinheap pointer", func() { v.Pointer() })
+       shouldPanic("reflect: reflect.Value.UnsafePointer on an invalid notinheap pointer", func() { v.UnsafePointer() })
 }
 
 func TestMethodCallValueCodePtr(t *testing.T) {

diff --git a/src/reflect/value.go b/src/reflect/value.go
index 7bb8ae5b974026458ebf86cb1b1731b924048bb8..3e723e82a41a7a86d42629bd270817cc4b5a9723 100644 (file)
--- a/src/reflect/value.go
+++ b/src/reflect/value.go
@@ -1940,11 +1940,13 @@ func (v Value) Pointer() uintptr {
        switch k {
        case Ptr:
                if v.typ.ptrdata == 0 {
-                       // Handle pointers to go:notinheap types directly,
-                       // so we never materialize such pointers as an
-                       // unsafe.Pointer. (Such pointers are always indirect.)
-                       // See issue 42076.
-                       return *(*uintptr)(v.ptr)
+                       val := *(*uintptr)(v.ptr)
+                       // Since it is a not-in-heap pointer, all pointers to the heap are
+                       // forbidden! See comment in Value.Elem and issue #48399.
+                       if !verifyNotInHeapPtr(val) {
+                               panic("reflect: reflect.Value.Pointer on an invalid notinheap pointer")
+                       }
+                       return val
                }
                fallthrough
        case Chan, Map, UnsafePointer: