diff options
| author | Florian Hahn <flo@fhahn.com> | 2019-07-11 09:57:00 +0000 |
|---|---|---|
| committer | Florian Hahn <flo@fhahn.com> | 2019-07-11 09:57:00 +0000 |
| commit | 8b222ecf2769ee133691f208f6166ce118c4a164 (patch) | |
| tree | 69f82fb87e1eb3297bfb14e264c7126b97cb6b53 | |
| parent | 08b4a8da07aa2335c44a40aa5a9951c2ee909e6b (diff) | |
| download | bcm5719-llvm-8b222ecf2769ee133691f208f6166ce118c4a164.tar.gz bcm5719-llvm-8b222ecf2769ee133691f208f6166ce118c4a164.zip | |
[BitcodeReader] Validate OpNum, before accessing Record array.
Currently invalid bitcode files can cause a crash, when OpNum exceeds
the number of elements in Record, like in the attached bitcode file.
The test case was generated by clusterfuzz: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15698
Reviewers: t.p.northover, thegameg, jfb
Reviewed By: jfb
Differential Revision: https://reviews.llvm.org/D64507
llvm-svn: 365750
| -rw-r--r-- | llvm/lib/Bitcode/Reader/BitcodeReader.cpp | 4 | ||||
| -rw-r--r-- | llvm/test/Bitcode/Inputs/invalid-fcmp-opnum.bc | bin | 0 -> 908 bytes | |||
| -rw-r--r-- | llvm/test/Bitcode/invalid.test | 5 |
3 files changed, 9 insertions, 0 deletions
diff --git a/llvm/lib/Bitcode/Reader/BitcodeReader.cpp b/llvm/lib/Bitcode/Reader/BitcodeReader.cpp index 0ba76f0f371..0d302b7dfaa 100644 --- a/llvm/lib/Bitcode/Reader/BitcodeReader.cpp +++ b/llvm/lib/Bitcode/Reader/BitcodeReader.cpp @@ -4165,6 +4165,10 @@ Error BitcodeReader::parseFunctionBody(Function *F) { popValue(Record, OpNum, NextValueNo, LHS->getType(), RHS)) return error("Invalid record"); + if (OpNum >= Record.size()) + return error( + "Invalid record: operand number exceeded available operands"); + unsigned PredVal = Record[OpNum]; bool IsFP = LHS->getType()->isFPOrFPVectorTy(); FastMathFlags FMF; diff --git a/llvm/test/Bitcode/Inputs/invalid-fcmp-opnum.bc b/llvm/test/Bitcode/Inputs/invalid-fcmp-opnum.bc Binary files differnew file mode 100644 index 00000000000..454a14b8611 --- /dev/null +++ b/llvm/test/Bitcode/Inputs/invalid-fcmp-opnum.bc diff --git a/llvm/test/Bitcode/invalid.test b/llvm/test/Bitcode/invalid.test index 2a9af0626c6..d1f9d7c0874 100644 --- a/llvm/test/Bitcode/invalid.test +++ b/llvm/test/Bitcode/invalid.test @@ -235,3 +235,8 @@ RUN: not llvm-dis -disable-output %p/Inputs/invalid-nonpointer-atomicrmw.bc 2>&1 RUN: FileCheck --check-prefix=NONPOINTER-ATOMICRMW %s NONPOINTER-ATOMICRMW: Invalid record + +RUN: not llvm-dis -disable-output %p/Inputs/invalid-fcmp-opnum.bc 2>&1 | \ +RUN: FileCheck --check-prefix=INVALID-FCMP-OPNUM %s + +INVALID-FCMP-OPNUM: Invalid record: operand number exceeded available operands |
