This is an archive of the discontinued LLVM Phabricator instance.

Differential D9016

Be more strict about the operand for the array type in BitcodeReader
ClosedPublic

Authored by filcab on Apr 14 2015, 7:56 AM.

Details

Reviewers
• rafael
Commits
rG6621cb7478f0: Be more strict about the operand for the array type in BitcodeReader
rL235596: Be more strict about the operand for the array type in BitcodeReader
Summary

Bug found with AFL.

Diff Detail

Repository
rL LLVM

Event Timeline

filcab updated this revision to Diff 23734.Apr 14 2015, 7:56 AM
filcab retitled this revision from to Be more strict about the operand for the array type in BitcodeReader.
filcab updated this object.
filcab edited the test plan for this revision. (Show Details)
filcab added a reviewer: • rafael.
filcab added a subscriber: Unknown Object (MLST).
• rafael accepted this revision.Apr 23 2015, 6:34 AM
• rafael edited edge metadata.

LGTM

This revision is now accepted and ready to land.Apr 23 2015, 6:34 AM
Closed by commit rL235596: Be more strict about the operand for the array type in BitcodeReader (authored by filcab). · Explain WhyApr 23 2015, 6:41 AM
This revision was automatically updated to reflect the committed changes.

Revision Contents

PathSize
llvm/
trunk/
lib/
Bitcode/
Reader/
3 lines
test/
Bitcode/
Inputs/
5 lines

Diff 24302

llvm/trunk/lib/Bitcode/Reader/BitstreamReader.cpp

Show First 20 Lines • Show All 195 Lines • ▼ Show 20 Lines for (unsigned i = 1, e = Abbv->getNumOperandInfos(); i != e; ++i) {
if (Op.getEncoding() == BitCodeAbbrevOp::Array) { if (Op.getEncoding() == BitCodeAbbrevOp::Array) {
// Array case. Read the number of elements as a vbr6. // Array case. Read the number of elements as a vbr6.
unsigned NumElts = ReadVBR(6); unsigned NumElts = ReadVBR(6);
// Get the element encoding. // Get the element encoding.
assert(i+2 == e && "array op not second to last?"); assert(i+2 == e && "array op not second to last?");
const BitCodeAbbrevOp &EltEnc = Abbv->getOperandInfo(++i); const BitCodeAbbrevOp &EltEnc = Abbv->getOperandInfo(++i);
if (EltEnc.getEncoding() == BitCodeAbbrevOp::Array ||
EltEnc.getEncoding() == BitCodeAbbrevOp::Blob)
report_fatal_error("Array element type can't be an Array or a Blob");
// Read all the elements. // Read all the elements.
for (; NumElts; --NumElts) for (; NumElts; --NumElts)
Vals.push_back(readAbbreviatedField(*this, EltEnc)); Vals.push_back(readAbbreviatedField(*this, EltEnc));
continue; continue;
} }
assert(Op.getEncoding() == BitCodeAbbrevOp::Blob); assert(Op.getEncoding() == BitCodeAbbrevOp::Blob);
▲ Show 20 Lines • Show All 139 Lines • Show Last 20 Lines

llvm/trunk/test/Bitcode/Inputs/invalid-array-type.bc

  • This is a binary file.

llvm/trunk/test/Bitcode/invalid.test

Show First 20 Lines • Show All 67 Lines • ▼ Show 20 Lines
FP-SHIFT: Invalid record FP-SHIFT: Invalid record
RUN: not llvm-dis -disable-output %p/Inputs/invalid-abbrev-vbr-size-too-big.bc 2>&1 | \ RUN: not llvm-dis -disable-output %p/Inputs/invalid-abbrev-vbr-size-too-big.bc 2>&1 | \
RUN: FileCheck --check-prefix=HUGE-ABBREV-OP %s RUN: FileCheck --check-prefix=HUGE-ABBREV-OP %s
RUN: not llvm-dis -disable-output %p/Inputs/invalid-abbrev-fixed-size-too-big.bc 2>&1 | \ RUN: not llvm-dis -disable-output %p/Inputs/invalid-abbrev-fixed-size-too-big.bc 2>&1 | \
RUN: FileCheck --check-prefix=HUGE-ABBREV-OP %s RUN: FileCheck --check-prefix=HUGE-ABBREV-OP %s
HUGE-ABBREV-OP: Fixed or VBR abbrev record with size > MaxChunkData HUGE-ABBREV-OP: Fixed or VBR abbrev record with size > MaxChunkData
RUN: not llvm-dis -disable-output %p/Inputs/invalid-array-type.bc 2>&1 | \
RUN: FileCheck --check-prefix=ARRAY-TYPE %s
ARRAY-TYPE: Array element type can't be an Array or a Blob