diff options
| author | Filipe Cabecinhas <me@filcab.net> | 2015-05-19 00:34:17 +0000 |
|---|---|---|
| committer | Filipe Cabecinhas <me@filcab.net> | 2015-05-19 00:34:17 +0000 |
| commit | f3fa99c48e2a69b2df4a06249b987919b744acd9 (patch) | |
| tree | b1a30e4096cf48a9c78f0ea70962498e9541f8d9 | |
| parent | 887fdfb7592fd5b14a2d7fb50ee56f00d6ffeb58 (diff) | |
| download | bcm5719-llvm-f3fa99c48e2a69b2df4a06249b987919b744acd9.tar.gz bcm5719-llvm-f3fa99c48e2a69b2df4a06249b987919b744acd9.zip | |
[BitcodeReader] It's a malformed block if CodeLenWidth is too big
Bug found with AFL fuzz.
llvm-svn: 237646
| -rw-r--r-- | llvm/lib/Bitcode/Reader/BitstreamReader.cpp | 4 | ||||
| -rw-r--r-- | llvm/test/Bitcode/Inputs/invalid-code-len-width.bc | bin | 0 -> 173 bytes | |||
| -rw-r--r-- | llvm/test/Bitcode/invalid.test | 5 |
3 files changed, 9 insertions, 0 deletions
diff --git a/llvm/lib/Bitcode/Reader/BitstreamReader.cpp b/llvm/lib/Bitcode/Reader/BitstreamReader.cpp index dff6d181486..450bbbc4558 100644 --- a/llvm/lib/Bitcode/Reader/BitstreamReader.cpp +++ b/llvm/lib/Bitcode/Reader/BitstreamReader.cpp @@ -39,6 +39,10 @@ bool BitstreamCursor::EnterSubBlock(unsigned BlockID, unsigned *NumWordsP) { // Get the codesize of this block. CurCodeSize = ReadVBR(bitc::CodeLenWidth); + // We can't read more than MaxChunkSize at a time + if (CurCodeSize > MaxChunkSize) + return true; + SkipToFourByteBoundary(); unsigned NumWords = Read(bitc::BlockSizeWidth); if (NumWordsP) *NumWordsP = NumWords; diff --git a/llvm/test/Bitcode/Inputs/invalid-code-len-width.bc b/llvm/test/Bitcode/Inputs/invalid-code-len-width.bc Binary files differnew file mode 100644 index 00000000000..c8e8c4f6653 --- /dev/null +++ b/llvm/test/Bitcode/Inputs/invalid-code-len-width.bc diff --git a/llvm/test/Bitcode/invalid.test b/llvm/test/Bitcode/invalid.test index 921d4e62c04..c4c635e08d3 100644 --- a/llvm/test/Bitcode/invalid.test +++ b/llvm/test/Bitcode/invalid.test @@ -147,3 +147,8 @@ RUN: not llvm-dis -disable-output %p/Inputs/invalid-inserted-value-type-mismatch RUN: FileCheck --check-prefix=INSERT-TYPE-MISMATCH %s INSERT-TYPE-MISMATCH: Inserted value type doesn't match aggregate type + +RUN: not llvm-dis -disable-output %p/Inputs/invalid-code-len-width.bc 2>&1 | \ +RUN: FileCheck --check-prefix=INVALID-CODELENWIDTH %s + +INVALID-CODELENWIDTH: Malformed block |
