maxjhandsome
/
llvm-project
forked from OSchip/llvm-project
1
0
Fork 0
Code Issues Pull Requests Packages Releases Wiki Activity

[BinaryFormat] Fix out of bounds read. 

Found by OSS-FUZZ!
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3220

llvm-svn: 312238
This commit is contained in:
Benjamin Kramer 2017-08-31 12:50:42 +00:00
parent bfcac0b480
commit 80df642395
2 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
llvm/lib/BinaryFormat/Magic.cpp
View File

@ -182,7 +182,7 @@ file_magic llvm::identify_magic(StringRef Magic) {
break;
case 'M': // Possible MS-DOS stub on Windows PE file
if (startswith(Magic, "MZ")) {
if (startswith(Magic, "MZ") && Magic.size() >= 0x3c + 4) {
uint32_t off = read32le(Magic.data() + 0x3c);
// PE/COFF file, either EXE or DLL.
if (off < Magic.size() &&

5
llvm/unittests/BinaryFormat/TestFileMagic.cpp
View File

@ -80,6 +80,7 @@ const char windows_resource[] =
"\x00\x00\x00\x00\x020\x00\x00\x00\xff\xff\x00\x00\xff\xff\x00\x00";
const char macho_dynamically_linked_shared_lib_stub[] =
"\xfe\xed\xfa\xce........\x00\x00\x00\x09............";
const char ms_dos_stub_broken[] = "\x4d\x5a\x20\x20";
TEST_F(MagicTest, Magic) {
struct type {
@ -108,7 +109,9 @@ TEST_F(MagicTest, Magic) {
DEFINE(macho_dynamically_linked_shared_lib_stub),
DEFINE(macho_dsym_companion),
DEFINE(macho_kext_bundle),
DEFINE(windows_resource)
DEFINE(windows_resource),
{"ms_dos_stub_broken", ms_dos_stub_broken, sizeof(ms_dos_stub_broken),
file_magic::unknown},
#undef DEFINE
};