Menu

#857 The shim frees the Verilator context while the model is still using it

v1.0 (example)
open
nobody
None
5
2026-08-09
2026-08-09
No

Found by Claude Code

In upstream's verilator_shim.cpp, Cosim_setup() declares the Verilator context as a local std::unique_ptr<verilatedcontext>. When the function returns, the unique_ptr destructor deletes the context — but the Verilog model object outlives the function and keeps a raw pointer to it. On the --timing code path, step() later calls topp->contextp(), dereferencing freed memory. That is a use-after-free in shipped ngspice code, independent of anything we added. Our patch releases ownership from the unique_ptr so the context lives for the whole process; we needed it anyway because the trace setup also uses the context.</verilatedcontext>

Discussion


Log in to post a comment.