diff options
| author | Filipe Cabecinhas <me@filcab.net> | 2015-06-03 00:05:30 +0000 |
|---|---|---|
| committer | Filipe Cabecinhas <me@filcab.net> | 2015-06-03 00:05:30 +0000 |
| commit | 8e42190d2038d129f9ebec8e83a5380cf0fcff30 (patch) | |
| tree | f35eb27f3dee7763bb98cf4c27ed1f411fe3c78d | |
| parent | 9aa3ab30a9ccd1aaf6ffb62d03785c887a6e4c81 (diff) | |
| download | bcm5719-llvm-8e42190d2038d129f9ebec8e83a5380cf0fcff30.tar.gz bcm5719-llvm-8e42190d2038d129f9ebec8e83a5380cf0fcff30.zip | |
[BitcodeReader] Check vector size before trying to create a VectorType
Bug found with AFL fuzz
llvm-svn: 238891
| -rw-r--r-- | llvm/lib/Bitcode/Reader/BitcodeReader.cpp | 2 | ||||
| -rw-r--r-- | llvm/test/Bitcode/Inputs/invalid-vector-length.bc | bin | 0 -> 512 bytes | |||
| -rw-r--r-- | llvm/test/Bitcode/invalid.test | 5 |
3 files changed, 7 insertions, 0 deletions
diff --git a/llvm/lib/Bitcode/Reader/BitcodeReader.cpp b/llvm/lib/Bitcode/Reader/BitcodeReader.cpp index 4044ac80f20..9e5e46aae0b 100644 --- a/llvm/lib/Bitcode/Reader/BitcodeReader.cpp +++ b/llvm/lib/Bitcode/Reader/BitcodeReader.cpp @@ -1497,6 +1497,8 @@ std::error_code BitcodeReader::ParseTypeTableBody() { case bitc::TYPE_CODE_VECTOR: // VECTOR: [numelts, eltty] if (Record.size() < 2) return Error("Invalid record"); + if (Record[0] == 0) + return Error("Invalid vector length"); ResultTy = getTypeByID(Record[1]); if (!ResultTy || !StructType::isValidElementType(ResultTy)) return Error("Invalid type"); diff --git a/llvm/test/Bitcode/Inputs/invalid-vector-length.bc b/llvm/test/Bitcode/Inputs/invalid-vector-length.bc Binary files differnew file mode 100644 index 00000000000..94b13ed0c37 --- /dev/null +++ b/llvm/test/Bitcode/Inputs/invalid-vector-length.bc diff --git a/llvm/test/Bitcode/invalid.test b/llvm/test/Bitcode/invalid.test index 43f7c77d598..b120047e451 100644 --- a/llvm/test/Bitcode/invalid.test +++ b/llvm/test/Bitcode/invalid.test @@ -192,3 +192,8 @@ RUN: not llvm-dis -disable-output %p/Inputs/invalid-metadata-not-followed-named- RUN: FileCheck --check-prefix=META-NOT-FOLLOWED-BY-NAMED-META %s META-NOT-FOLLOWED-BY-NAMED-META: METADATA_NAME not followed by METADATA_NAMED_NODE + +RUN: not llvm-dis -disable-output %p/Inputs/invalid-vector-length.bc 2>&1 | \ +RUN: FileCheck --check-prefix=VECTOR-LENGTH %s + +VECTOR-LENGTH: Invalid vector length |
