maxjhandsome
/
llvm-project
forked from OSchip/llvm-project
1
0
Fork 0
Code Issues Pull Requests Packages Releases Wiki Activity

Recommit "[BitcodeReader] Validate OpNum, before accessing Record array." 

This recommits r365750 (git commit 8b222ecf27)

Original message:

   Currently invalid bitcode files can cause a crash, when OpNum exceeds
   the number of elements in Record, like in the attached bitcode file.

   The test case was generated by clusterfuzz: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15698

   Reviewers: t.p.northover, thegameg, jfb

   Reviewed By: jfb

   Differential Revision: https://reviews.llvm.org/D64507

   llvm-svn: 365750jkkkk

llvm-svn: 366018
This commit is contained in:
Florian Hahn 2019-07-14 14:06:25 +00:00
parent 864474c9c7
commit 19d3fdb08b
3 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
llvm/lib/Bitcode/Reader/BitcodeReader.cpp
View File

@ -4171,6 +4171,10 @@ Error BitcodeReader::parseFunctionBody(Function *F) {
popValue(Record, OpNum, NextValueNo, LHS->getType(), RHS)) popValue(Record, OpNum, NextValueNo, LHS->getType(), RHS))
return error("Invalid record"); return error("Invalid record");
if (OpNum >= Record.size())
return error(
"Invalid record: operand number exceeded available operands");
unsigned PredVal = Record[OpNum]; unsigned PredVal = Record[OpNum];
bool IsFP = LHS->getType()->isFPOrFPVectorTy(); bool IsFP = LHS->getType()->isFPOrFPVectorTy();
FastMathFlags FMF; FastMathFlags FMF;

BIN
llvm/test/Bitcode/Inputs/invalid-fcmp-opnum.bc Normal file
View File

Binary file not shown.

5
llvm/test/Bitcode/invalid.test
View File

@ -235,3 +235,8 @@ RUN: not llvm-dis -disable-output %p/Inputs/invalid-nonpointer-atomicrmw.bc 2>&1
RUN: FileCheck --check-prefix=NONPOINTER-ATOMICRMW %s RUN: FileCheck --check-prefix=NONPOINTER-ATOMICRMW %s
NONPOINTER-ATOMICRMW: Invalid record NONPOINTER-ATOMICRMW: Invalid record
RUN: not llvm-dis -disable-output %p/Inputs/invalid-fcmp-opnum.bc 2>&1 | \
RUN: FileCheck --check-prefix=INVALID-FCMP-OPNUM %s
INVALID-FCMP-OPNUM: Invalid record: operand number exceeded available operands