From 55680d0addfa6536f9d51217fa814e8aa4889824 Mon Sep 17 00:00:00 2001 From: Rafael Espindola Date: Thu, 19 Oct 2017 01:25:48 +0000 Subject: [PATCH] Fix buffer overflow. We were reading past the end of the buffer. llvm-svn: 316143 --- llvm/lib/BinaryFormat/Magic.cpp | 2 +- .../Object/Inputs/invalid-coff-header-too-small | Bin 0 -> 64 bytes llvm/test/Object/invalid.test | 3 +++ 3 files changed, 4 insertions(+), 1 deletion(-) create mode 100644 llvm/test/Object/Inputs/invalid-coff-header-too-small diff --git a/llvm/lib/BinaryFormat/Magic.cpp b/llvm/lib/BinaryFormat/Magic.cpp index e9b8df93b902..db8e9526e647 100644 --- a/llvm/lib/BinaryFormat/Magic.cpp +++ b/llvm/lib/BinaryFormat/Magic.cpp @@ -185,7 +185,7 @@ file_magic llvm::identify_magic(StringRef Magic) { if (startswith(Magic, "MZ") && Magic.size() >= 0x3c + 4) { uint32_t off = read32le(Magic.data() + 0x3c); // PE/COFF file, either EXE or DLL. - if (off < Magic.size() && + if (off + sizeof(COFF::PEMagic) <= Magic.size() && memcmp(Magic.data() + off, COFF::PEMagic, sizeof(COFF::PEMagic)) == 0) return file_magic::pecoff_executable; } diff --git a/llvm/test/Object/Inputs/invalid-coff-header-too-small b/llvm/test/Object/Inputs/invalid-coff-header-too-small new file mode 100644 index 0000000000000000000000000000000000000000..c9f0c965b7663a7b8e6d6e8512f0e01464fc693b GIT binary patch literal 64 QcmeZ`QXm`HGcYg!03DGCCjbBd literal 0 HcmV?d00001 diff --git a/llvm/test/Object/invalid.test b/llvm/test/Object/invalid.test index b0b5528ab05b..6899f5ab0572 100644 --- a/llvm/test/Object/invalid.test +++ b/llvm/test/Object/invalid.test @@ -86,3 +86,6 @@ INVALID-REL-SYM: invalid section offset RUN: not llvm-readobj -r %p/Inputs/invalid-buffer.elf 2>&1 | FileCheck --check-prefix=INVALID-BUFFER %s INVALID-BUFFER: Invalid buffer + +RUN: not llvm-readobj %p/Inputs/invalid-coff-header-too-small 2>&1 | FileCheck --check-prefix=COFF-HEADER %s +COFF-HEADER: The file was not recognized as a valid object file