diff --git a/llvm/lib/Support/MemoryBuffer.cpp b/llvm/lib/Support/MemoryBuffer.cpp --- a/llvm/lib/Support/MemoryBuffer.cpp +++ b/llvm/lib/Support/MemoryBuffer.cpp @@ -286,6 +286,8 @@ StringRef NameRef = BufferName.toStringRef(NameBuf); size_t AlignedStringLen = alignTo(sizeof(MemBuffer) + NameRef.size() + 1, 16); size_t RealLen = AlignedStringLen + Size + 1; + if (RealLen <= Size) // Check for rollover. + return nullptr; char *Mem = static_cast(operator new(RealLen, std::nothrow)); if (!Mem) return nullptr; diff --git a/llvm/unittests/Support/MemoryBufferTest.cpp b/llvm/unittests/Support/MemoryBufferTest.cpp --- a/llvm/unittests/Support/MemoryBufferTest.cpp +++ b/llvm/unittests/Support/MemoryBufferTest.cpp @@ -219,6 +219,11 @@ EXPECT_NE(nullptr, Four.get()); for (size_t i = 0; i < 123; ++i) EXPECT_EQ(0, Four->getBufferStart()[0]); + + // uninitialized buffer with rollover size + OwningBuffer Five( + WritableMemoryBuffer::getNewUninitMemBuffer(SIZE_MAX, "huge")); + EXPECT_EQ(nullptr, Five.get()); } void MemoryBufferTest::testGetOpenFileSlice(bool Reopen) {