Index: lib/ubsan/ubsan_type_hash.h
===================================================================
--- lib/ubsan/ubsan_type_hash.h
+++ lib/ubsan/ubsan_type_hash.h
@@ -53,6 +53,10 @@
 
 const unsigned VptrTypeCacheSize = 128;
 
+/// A sanity check for Vtable. Offsets must be non-negative and
+/// no larger than this value. It's a weak check for Vtable corruption.
+const int VptrMaxOffset = 1<<20;
+
 /// \brief A cache of the results of checkDynamicType. \c checkDynamicType would
 /// return \c true (modulo hash collisions) if
 /// \code
Index: lib/ubsan/ubsan_type_hash_itanium.cc
===================================================================
--- lib/ubsan/ubsan_type_hash_itanium.cc
+++ lib/ubsan/ubsan_type_hash_itanium.cc
@@ -221,6 +221,10 @@
   VtablePrefix *Vtable = getVtablePrefix(VtablePtr);
   if (!Vtable)
     return false;
+  if (Vtable->Offset < -VptrMaxOffset || Vtable->Offset > VptrMaxOffset) {
+    // Too large or too small offset are signs of Vtable corruption.
+    return false;
+  }
 
   // Check that this is actually a type_info object for a class type.
   abi::__class_type_info *Derived =
@@ -241,7 +245,8 @@
 __ubsan::DynamicTypeInfo
 __ubsan::getDynamicTypeInfoFromVtable(void *VtablePtr) {
   VtablePrefix *Vtable = getVtablePrefix(VtablePtr);
-  if (!Vtable)
+  if (!Vtable || Vtable->Offset < -VptrMaxOffset ||
+      Vtable->Offset > VptrMaxOffset)
     return DynamicTypeInfo(0, 0, 0);
   const abi::__class_type_info *ObjectType = findBaseAtOffset(
     static_cast<const abi::__class_type_info*>(Vtable->TypeInfo),