maxjhandsome
/
llvm-project
forked from OSchip/llvm-project
1
0
Fork 0
Code Issues Pull Requests Packages Releases Wiki Activity

Don't overflow GCTable 

Summary: Bug found with AFL fuzz.

Reviewers: rafael, dexonsmith

Subscribers: llvm-commits

Differential Revision: http://reviews.llvm.org/D9361

llvm-svn: 236200
This commit is contained in:
Filipe Cabecinhas 2015-04-30 04:09:41 +00:00
parent d8a029c81b
commit f8a16a952d
3 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
llvm/lib/Bitcode/Reader/BitcodeReader.cpp
View File

@ -2992,7 +2992,7 @@ std::error_code BitcodeReader::ParseModule(bool Resume,
// FIXME: Change to an error if non-default in 4.0.
Func->setVisibility(GetDecodedVisibility(Record[7]));
if (Record.size() > 8 && Record[8]) {
if (Record[8]-1 > GCTable.size())
if (Record[8]-1 >= GCTable.size())
return Error("Invalid ID");
Func->setGC(GCTable[Record[8]-1].c_str());
}

BIN
llvm/test/Bitcode/Inputs/invalid-GCTable-overflow.bc Normal file
View File

Binary file not shown.

5
llvm/test/Bitcode/invalid.test
View File

@ -122,3 +122,8 @@ RUN: not llvm-dis -disable-output %p/Inputs/invalid-load-pointer-type.bc 2>&1 |
RUN: FileCheck --check-prefix=LOAD-BAD-TYPE %s
LOAD-BAD-TYPE: Load operand is not a pointer type
RUN: not llvm-dis -disable-output %p/Inputs/invalid-GCTable-overflow.bc 2>&1 | \
RUN: FileCheck --check-prefix=GCTABLE-OFLOW %s
GCTABLE-OFLOW: Invalid ID