diff options
| author | Filipe Cabecinhas <me@filcab.net> | 2015-05-19 00:34:17 +0000 |
|---|---|---|
| committer | Filipe Cabecinhas <me@filcab.net> | 2015-05-19 00:34:17 +0000 |
| commit | f3fa99c48e2a69b2df4a06249b987919b744acd9 (patch) | |
| tree | b1a30e4096cf48a9c78f0ea70962498e9541f8d9 /llvm/lib/Bitcode/Reader/BitstreamReader.cpp | |
| parent | 887fdfb7592fd5b14a2d7fb50ee56f00d6ffeb58 (diff) | |
| download | bcm5719-llvm-f3fa99c48e2a69b2df4a06249b987919b744acd9.tar.gz bcm5719-llvm-f3fa99c48e2a69b2df4a06249b987919b744acd9.zip | |
[BitcodeReader] It's a malformed block if CodeLenWidth is too big
Bug found with AFL fuzz.
llvm-svn: 237646
Diffstat (limited to 'llvm/lib/Bitcode/Reader/BitstreamReader.cpp')
| -rw-r--r-- | llvm/lib/Bitcode/Reader/BitstreamReader.cpp | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/llvm/lib/Bitcode/Reader/BitstreamReader.cpp b/llvm/lib/Bitcode/Reader/BitstreamReader.cpp index dff6d181486..450bbbc4558 100644 --- a/llvm/lib/Bitcode/Reader/BitstreamReader.cpp +++ b/llvm/lib/Bitcode/Reader/BitstreamReader.cpp @@ -39,6 +39,10 @@ bool BitstreamCursor::EnterSubBlock(unsigned BlockID, unsigned *NumWordsP) { // Get the codesize of this block. CurCodeSize = ReadVBR(bitc::CodeLenWidth); + // We can't read more than MaxChunkSize at a time + if (CurCodeSize > MaxChunkSize) + return true; + SkipToFourByteBoundary(); unsigned NumWords = Read(bitc::BlockSizeWidth); if (NumWordsP) *NumWordsP = NumWords; |
