This is an archive of the discontinued LLVM Phabricator instance.

Fix buffer-overflow in llvm-mt's notify_update feature.
ClosedPublic

Authored by hctim on Dec 6 2022, 1:37 PM.

Details

Summary

The 3-parameter std::equal used in this code access FileBuffer from [0,
OutputBuffer->getBufferEnd() - OutputBuffer->getBufferStart()). If the
size of FileBuffer is shorter than OutputBuffer, this ends up
overflowing.

This wasn't found on the sanitizer buildbots as they use an instrumented
libcxx, and libcxx implements std::equal using a loop. libstdc++ on my
local macine finds the bug, as it implements std::equal using bcmp(),
which ASan intercepts and does a range check.

The existing test doesn't technically do a buffer-overflow, but the code
definitely can. If OutputBuffer was "AAABBB" and FileBuffer was "AAA",
then the code would overflow.

Diff Detail

Event Timeline

hctim created this revision.Dec 6 2022, 1:37 PM
Herald added a project: Restricted Project. · View Herald TranscriptDec 6 2022, 1:37 PM
hctim requested review of this revision.Dec 6 2022, 1:37 PM
Herald added a project: Restricted Project. · View Herald TranscriptDec 6 2022, 1:37 PM
abrachet accepted this revision.Dec 6 2022, 1:44 PM

Thanks for catching it, there is already D139315 which should address this too. But this is good to go if you want to submit it now

This revision is now accepted and ready to land.Dec 6 2022, 1:44 PM
This revision was landed with ongoing or failed builds.Dec 6 2022, 1:46 PM
This revision was automatically updated to reflect the committed changes.