maxjhandsome
/
llvm-project
forked from OSchip/llvm-project
1
0
Fork 0
Code Issues Pull Requests Packages Releases Wiki Activity

Fix llvm-special-case-list-fuzzer regexp exception 

Summary:
Original oss-fuzz report:
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3727#c2

The minimized test case that causes this failure:
5b 5b 5b 3d 47 53 00 5b  3d 5d 5b 5d 0a     [[[=GS.[=][].

Note the string "=GS\x00". The failure happens because the code is
searching the string against an array of known collated names. "GS\x00"
is a hit, but since len takes into account an extra NUL byte, indexing
into cp->name[len] goes one byte past it's allocated memory. Fix this to
use a strlen(cp->name) comparison to account for NUL bytes in the input.

Reviewers: pcc

Reviewed By: pcc

Subscribers: hctim, kcc

Differential Revision: https://reviews.llvm.org/D39380

llvm-svn: 316786
This commit is contained in:
Vlad Tsyrklevich 2017-10-27 19:15:13 +00:00
parent 92a2635bbd
commit b42db1567c
2 changed files with 10 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
llvm/lib/Support/regcomp.c
View File

@ -1008,7 +1008,7 @@ p_b_coll_elem(struct parse *p,
{ {
char *sp = p->next; char *sp = p->next;
struct cname *cp; struct cname *cp;
int len; size_t len;
while (MORE() && !SEETWO(endc, ']')) while (MORE() && !SEETWO(endc, ']'))
NEXT(); NEXT();
@ -1018,7 +1018,7 @@ p_b_coll_elem(struct parse *p,
} }
len = p->next - sp; len = p->next - sp;
for (cp = cnames; cp->name != NULL; cp++) for (cp = cnames; cp->name != NULL; cp++)
if (strncmp(cp->name, sp, len) == 0 && cp->name[len] == '\0') if (strncmp(cp->name, sp, len) == 0 && strlen(cp->name) == len)
return(cp->code); /* known name */ return(cp->code); /* known name */
if (len == 1) if (len == 1)
return(*sp); /* single character */ return(*sp); /* single character */

8
llvm/unittests/Support/RegexTest.cpp
View File

@ -171,4 +171,12 @@ TEST_F(RegexTest, MatchInvalid) {
EXPECT_FALSE(r1.match("X")); EXPECT_FALSE(r1.match("X"));
} }
// https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3727
TEST_F(RegexTest, OssFuzz3727Regression) {
// Wrap in a StringRef so the NUL byte doesn't terminate the string
Regex r(StringRef("[[[=GS\x00[=][", 10));
std::string Error;
EXPECT_FALSE(r.isValid(Error));
}
} }