[ELF] - Do not crash when object has multiple SHT_MIPS_OPTIONS

Issue was revealed by AFl and I was able to generate such object using yaml2obj.

When object has more than one SHT_MIPS_OPTIONS, 
each except the last one is destroyed after placing into Sections array.
Sections array contains dead pointers finally. LLD may crash then.

Differential revision: https://reviews.llvm.org/D25555

llvm-svn: 284227

2 files changed, 28 insertions, 0 deletions

diff --git a/lld/ELF/InputFiles.cpp b/lld/ELF/InputFiles.cpp
index 269d060eec9..3aafdbb93a7 100644
--- a/lld/ELF/InputFiles.cpp
+++ b/lld/ELF/InputFiles.cpp
@@ -324,6 +324,9 @@ elf::ObjectFile<ELFT>::createInputSection(const Elf_Shdr &Sec) {
     MipsReginfo.reset(new MipsReginfoInputSection<ELFT>(this, &Sec, Name));
     return MipsReginfo.get();
   case SHT_MIPS_OPTIONS:
+    if (MipsOptions)
+      fatal(getFilename(this) +
+            ": multiple SHT_MIPS_OPTIONS sections are not allowed");
     MipsOptions.reset(new MipsOptionsInputSection<ELFT>(this, &Sec, Name));
     return MipsOptions.get();
   case SHT_MIPS_ABIFLAGS:
diff --git a/lld/test/ELF/invalid/mips-multiple-options.test b/lld/test/ELF/invalid/mips-multiple-options.test
new file mode 100644
index 00000000000..647139a7244
--- /dev/null
+++ b/lld/test/ELF/invalid/mips-multiple-options.test
@@ -0,0 +1,25 @@
+# RUN: yaml2obj %s -o %t
+# RUN: not ld.lld %t -o %tout 2>&1 | FileCheck %s
+
+--- !ELF
+FileHeader:
+  Class:    ELFCLASS32
+  Data:     ELFDATA2LSB
+  Type:     ET_REL
+  Machine:  EM_MIPS
+  Flags:    [EF_MIPS_PIC, EF_MIPS_CPIC, EF_MIPS_ABI_O32, EF_MIPS_ARCH_32]
+
+Sections:
+  - Name:          .o1
+    Type:          SHT_MIPS_OPTIONS
+    Flags:         [ SHF_ALLOC, SHF_EXECINSTR ]
+    AddressAlign:  16
+    Content:       "010000000000000000000000"
+
+  - Name:          .o2
+    Type:          SHT_MIPS_OPTIONS
+    Flags:         [ SHF_ALLOC, SHF_EXECINSTR ]
+    AddressAlign:  16
+    Content:       "010000000000000000000000"
+
+# CHECK: multiple SHT_MIPS_OPTIONS sections are not allowed