This is an archive of the discontinued LLVM Phabricator instance.

Differential D9361

Don't overflow GCTable
ClosedPublic

Authored by filcab on Apr 29 2015, 6:46 PM.

Details

Reviewers
• rafael
dexonsmith
Commits
rGf8a16a952ddd: Don't overflow GCTable
rL236200: Don't overflow GCTable
Summary

Bug found with AFL fuzz.

Diff Detail

Event Timeline

filcab updated this revision to Diff 24673.Apr 29 2015, 6:46 PM
filcab retitled this revision from to Don't overflow GCTable.
filcab updated this object.
filcab edited the test plan for this revision. (Show Details)
filcab added reviewers: • rafael, dexonsmith.
filcab added a subscriber: Unknown Object (MLST).
Closed by commit rL236200: Don't overflow GCTable (authored by filcab). · Explain WhyApr 29 2015, 9:12 PM
This revision was automatically updated to reflect the committed changes.

Revision Contents

PathSize
lib/
Bitcode/
Reader/
2 lines
test/
Bitcode/
Inputs/
5 lines

Diff 24673

lib/Bitcode/Reader/BitcodeReader.cpp

Show First 20 Lines • Show All 2,986 Lines • ▼ Show 20 Lines case bitc::MODULE_CODE_FUNCTION: {
return Error("Invalid ID"); return Error("Invalid ID");
Func->setSection(SectionTable[Record[6]-1]); Func->setSection(SectionTable[Record[6]-1]);
} }
// Local linkage must have default visibility. // Local linkage must have default visibility.
if (!Func->hasLocalLinkage()) if (!Func->hasLocalLinkage())
// FIXME: Change to an error if non-default in 4.0. // FIXME: Change to an error if non-default in 4.0.
Func->setVisibility(GetDecodedVisibility(Record[7])); Func->setVisibility(GetDecodedVisibility(Record[7]));
if (Record.size() > 8 && Record[8]) { if (Record.size() > 8 && Record[8]) {
if (Record[8]-1 > GCTable.size()) if (Record[8]-1 >= GCTable.size())
return Error("Invalid ID"); return Error("Invalid ID");
Func->setGC(GCTable[Record[8]-1].c_str()); Func->setGC(GCTable[Record[8]-1].c_str());
} }
bool UnnamedAddr = false; bool UnnamedAddr = false;
if (Record.size() > 9) if (Record.size() > 9)
UnnamedAddr = Record[9]; UnnamedAddr = Record[9];
Func->setUnnamedAddr(UnnamedAddr); Func->setUnnamedAddr(UnnamedAddr);
if (Record.size() > 10 && Record[10] != 0) if (Record.size() > 10 && Record[10] != 0)
▲ Show 20 Lines • Show All 1,683 Lines • Show Last 20 Lines

test/Bitcode/Inputs/invalid-GCTable-overflow.bc

  • This binary file was added.
PropertyOld ValueNew Value
MIME Typenullapplication/octet-stream
File Size0 B452 B

test/Bitcode/invalid.test

Show First 20 Lines • Show All 116 Lines • ▼ Show 20 Lines
RUN: FileCheck --check-prefix=HUGE-FWDREF %s RUN: FileCheck --check-prefix=HUGE-FWDREF %s
HUGE-FWDREF: Invalid record HUGE-FWDREF: Invalid record
RUN: not llvm-dis -disable-output %p/Inputs/invalid-load-pointer-type.bc 2>&1 | \ RUN: not llvm-dis -disable-output %p/Inputs/invalid-load-pointer-type.bc 2>&1 | \
RUN: FileCheck --check-prefix=LOAD-BAD-TYPE %s RUN: FileCheck --check-prefix=LOAD-BAD-TYPE %s
LOAD-BAD-TYPE: Load operand is not a pointer type LOAD-BAD-TYPE: Load operand is not a pointer type
RUN: not llvm-dis -disable-output %p/Inputs/invalid-GCTable-overflow.bc 2>&1 | \
RUN: FileCheck --check-prefix=GCTABLE-OFLOW %s
GCTABLE-OFLOW: Invalid ID