diff options
| author | Filipe Cabecinhas <me@filcab.net> | 2015-04-23 13:25:35 +0000 |
|---|---|---|
| committer | Filipe Cabecinhas <me@filcab.net> | 2015-04-23 13:25:35 +0000 |
| commit | ee48feadfde407206eecce83ce460cccfeeffe10 (patch) | |
| tree | 7a08f69e1f632ea98049529acac14692ffa7ec69 /llvm/lib/Bitcode/Reader/BitstreamReader.cpp | |
| parent | 9316d89d55a16b2d30c0622de55aa1e73bb33b1a (diff) | |
| download | bcm5719-llvm-ee48feadfde407206eecce83ce460cccfeeffe10.tar.gz bcm5719-llvm-ee48feadfde407206eecce83ce460cccfeeffe10.zip | |
Verify sizes when trying to read a BitcodeAbbrevOp
Summary:
Make sure the abbrev operands are valid and that we can read/skip them
afterwards.
Bug found with AFL fuzz.
Reviewers: rafael
Subscribers: llvm-commits
Differential Revision: http://reviews.llvm.org/D9030
llvm-svn: 235595
Diffstat (limited to 'llvm/lib/Bitcode/Reader/BitstreamReader.cpp')
| -rw-r--r-- | llvm/lib/Bitcode/Reader/BitstreamReader.cpp | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/llvm/lib/Bitcode/Reader/BitstreamReader.cpp b/llvm/lib/Bitcode/Reader/BitstreamReader.cpp index beaaf7a7d66..ff37b8e4cfc 100644 --- a/llvm/lib/Bitcode/Reader/BitstreamReader.cpp +++ b/llvm/lib/Bitcode/Reader/BitstreamReader.cpp @@ -60,8 +60,10 @@ static uint64_t readAbbreviatedField(BitstreamCursor &Cursor, case BitCodeAbbrevOp::Blob: llvm_unreachable("Should not reach here"); case BitCodeAbbrevOp::Fixed: + assert((unsigned)Op.getEncodingData() <= Cursor.MaxChunkSize); return Cursor.Read((unsigned)Op.getEncodingData()); case BitCodeAbbrevOp::VBR: + assert((unsigned)Op.getEncodingData() <= Cursor.MaxChunkSize); return Cursor.ReadVBR64((unsigned)Op.getEncodingData()); case BitCodeAbbrevOp::Char6: return BitCodeAbbrevOp::DecodeChar6(Cursor.Read(6)); @@ -79,9 +81,11 @@ static void skipAbbreviatedField(BitstreamCursor &Cursor, case BitCodeAbbrevOp::Blob: llvm_unreachable("Should not reach here"); case BitCodeAbbrevOp::Fixed: + assert((unsigned)Op.getEncodingData() <= Cursor.MaxChunkSize); Cursor.Read((unsigned)Op.getEncodingData()); break; case BitCodeAbbrevOp::VBR: + assert((unsigned)Op.getEncodingData() <= Cursor.MaxChunkSize); Cursor.ReadVBR64((unsigned)Op.getEncodingData()); break; case BitCodeAbbrevOp::Char6: @@ -264,6 +268,11 @@ void BitstreamCursor::ReadAbbrevRecord() { continue; } + if ((E == BitCodeAbbrevOp::Fixed || E == BitCodeAbbrevOp::VBR) && + Data > MaxChunkSize) + report_fatal_error( + "Fixed or VBR abbrev record with size > MaxChunkData"); + Abbv->Add(BitCodeAbbrevOp(E, Data)); } else Abbv->Add(BitCodeAbbrevOp(E)); |
