Bugfix for collecting features from very small DSOs.

[aarongreen]

Summary

During unit tests, it was observed that crafting an artificially small DSO could cause OOB memory to be accessed. This change fixes that (but again, the affected DSOs are unlikely to ever occur outside unit tests).

[morehouse]

LGTM, thanks!

[aarongreen]

Rebase

[arichardson]

compiler-rt/lib/fuzzer/FuzzerTracePC.h

196

Just saw this while merging from upstream since we have a similar but conflicting diff. Shouldn't it be < rather than <=? I believe end is a one-past-the end pointer but it's been a while since I looked at this code? The loop below also uses <.

I made this change for CHERI a long time ago when porting libfuzzer but forgot to upstream it despite marking at as such: https://github.com/CTSRD-CHERI/llvm-project/commit/a09ee83464be3e287cdf82ff22e67d66f476a6c0

compiler-rt/lib/fuzzer/FuzzerTracePC.h

size_t ForEachNonZeroByte(const uint8_t *Begin, const uint8_t *End,
   const size_t StepMask = Step - 1;
   auto P = Begin;
   // Iterate by 1 byte until either the alignment boundary or the end.
   for (; reinterpret_cast<uintptr_t>(P) & StepMask && P < End; P++)
     if (uint8_t V = *P)
       Handle8bitCounter(FirstFeature, P - Begin, V);
 
   // Iterate by Step bytes at a time.
-  for (; P < End; P += Step)
+  for (; P + Step <= End; P += Step)
     if (LargeType Bundle = *reinterpret_cast<const LargeType *>(P)) {
       Bundle = HostToLE(Bundle);
       for (size_t I = 0; I < Step; I++, Bundle >>= 8)
         if (uint8_t V = Bundle & 0xff)
           Handle8bitCounter(FirstFeature, P - Begin + I, V);
     }
 
   // Iterate by 1 byte until the end.