[WebAssembly] Object: Add more error checking for object file reading

[sbc100]

Summary

This should address some the assert failures the fuzzer has been
finding such as:

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=6719

[jfb]

One comment, lgtm otherwise.

lib/Object/WasmObjectFile.cpp

961 ↗

(On Diff #147424)

That seems like readvaruint32 went out of valid range, no?

[sbc100]

lib/Object/WasmObjectFile.cpp

961 ↗

(On Diff #147424)

This means the reported segment size would make it go off the end of the data section.

The absolute value of Size could still be small.

llvm/trunk/lib/Object/WasmObjectFile.cpp

static int64_t readLEB128(const uint8_t *&Ptr) {
   unsigned Count;
   uint64_t Result = decodeSLEB128(Ptr, &Count);
   Ptr += Count;
   return Result;
 }
 
 static uint8_t readVaruint1(const uint8_t *&Ptr) {
   int64_t result = readLEB128(Ptr);
-  assert(result <= VARUINT1_MAX && result >= 0);
+  if (result > VARUINT1_MAX || result < 0)
+    report_fatal_error("LEB is outside Varuint1 range");
   return result;
 }
 
 static int32_t readVarint32(const uint8_t *&Ptr) {
   int64_t result = readLEB128(Ptr);
-  assert(result <= INT32_MAX && result >= INT32_MIN);
+  if (result > INT32_MAX || result < INT32_MIN)
+    report_fatal_error("LEB is outside Varint32 range");
   return result;
 }
 
 static uint32_t readVaruint32(const uint8_t *&Ptr) {
   uint64_t result = readULEB128(Ptr);
-  assert(result <= UINT32_MAX);
+  if (result > UINT32_MAX)
+    report_fatal_error("LEB is outside Varuint32 range");
   return result;
 }
 
 static int64_t readVarint64(const uint8_t *&Ptr) {
   return readLEB128(Ptr);
 }
 
 static uint8_t readOpcode(const uint8_t *&Ptr) {
Error WasmObjectFile::parseDataSection(const uint8_t *Ptr, const uint8_t *End) {
   uint32_t Count = readVaruint32(Ptr);
   DataSegments.reserve(Count);
   while (Count--) {
     WasmSegment Segment;
     Segment.Data.MemoryIndex = readVaruint32(Ptr);
     if (Error Err = readInitExpr(Segment.Data.Offset, Ptr))
       return Err;
     uint32_t Size = readVaruint32(Ptr);
+    if (Size > End - Ptr)
+      return make_error<GenericBinaryError>("Invalid segment size",
+                                            object_error::parse_failed);
     Segment.Data.Content = ArrayRef<uint8_t>(Ptr, Size);
     // The rest of these Data fields are set later, when reading in the linking
     // metadata section.
     Segment.Data.Alignment = 0;
     Segment.Data.Flags = 0;
     Segment.Data.Comdat = UINT32_MAX;
     Segment.SectionOffset = Ptr - Start;
     Ptr += Size;