[lld] Fix heap-buffer-overflow bugs identified by the Address Sanitizer

[garious]

Summary

MachO backend is reading memory when the atom content is empty. This patch adds guards to ensure the content exists before reading it.

[• rafael]

It needs a testcase.

lib/ReaderWriter/MachO/ArchHandler.cpp

145 ↗

(On Diff #20212)

You don't need the '{'

lib/ReaderWriter/MachO/CompactUnwindPass.cpp

414 ↗

(On Diff #20212)

Use an early return maybe?

[• rafael]

I just saw the comment about an existing test failing with asan. No need to add another one.

[garious]

Cleanup, per Rafael's feedback.

[kcc]

In D7733#125922, @rafael wrote:

I just saw the comment about an existing test failing with asan. No need to add another one.

Are we running that test on the bot(s)?

[garious]

To my knowledge, there isn't an ASan bot for LLD.

[• rafael]

Simple enough.

[kcc]

In D7733#126132, @garious wrote:

To my knowledge, there isn't an ASan bot for LLD.

Would you like to add lld testing to http://lab.llvm.org:8011/builders/sanitizer-x86_64-linux-fast/?
If yes, change zorg/buildbot/builders/sanitizers/buildbot_fast.sh and send review to Sergey Matveev <[e-mail]>

[garious]

@kcc, I'll see what I can do. Let's continue this discussion on llvmdev. LLD is now free of ASan errors, but I haven't yet had a chance to evaluate MSan. By the looks of those scripts, I should probably fix up any MSan-reported bugs before lighting up that bot.

lld/trunk/lib/ReaderWriter/MachO/ArchHandler.cpp

 }
 
   int64_t ArchHandler::readS64(const uint8_t *addr, bool isBig) {
   return read64(addr, isBig);
 }
 
 bool ArchHandler::isDwarfCIE(bool isBig, const DefinedAtom *atom) {
   assert(atom->contentType() == DefinedAtom::typeCFI);
+  if (atom->rawContent().size() < sizeof(uint32_t))
+    return false;
   uint32_t size = read32(atom->rawContent().data(), isBig);
 
   uint32_t idOffset = sizeof(uint32_t);
   if (size == 0xffffffffU)
     idOffset += sizeof(uint64_t);
 
   return read32(atom->rawContent().data() + idOffset, isBig) == 0;
 }

lld/trunk/lib/ReaderWriter/MachO/CompactUnwindPass.cpp

for (const Reference *ref : *atom) {
         break;
       case 0x18:
         assert(ref->addend() == 0 && "unexpected offset into LSDA atom");
         entry.lsdaLocation = ref->target();
         break;
       }
     }
 
+    if (atom->rawContent().size() < 4 * sizeof(uint32_t))
+      return entry;
+
     using normalized::read32;
     entry.rangeLength =
         read32(atom->rawContent().data() + 2 * sizeof(uint32_t), _isBig);
     entry.encoding =
         read32(atom->rawContent().data() + 3 * sizeof(uint32_t), _isBig);
     return entry;
   }