diff options
| author | Florian Hahn <flo@fhahn.com> | 2019-07-11 09:57:00 +0000 |
|---|---|---|
| committer | Florian Hahn <flo@fhahn.com> | 2019-07-11 09:57:00 +0000 |
| commit | 8b222ecf2769ee133691f208f6166ce118c4a164 (patch) | |
| tree | 69f82fb87e1eb3297bfb14e264c7126b97cb6b53 /llvm/lib/Bitcode/Reader | |
| parent | 08b4a8da07aa2335c44a40aa5a9951c2ee909e6b (diff) | |
| download | bcm5719-llvm-8b222ecf2769ee133691f208f6166ce118c4a164.tar.gz bcm5719-llvm-8b222ecf2769ee133691f208f6166ce118c4a164.zip | |
[BitcodeReader] Validate OpNum, before accessing Record array.
Currently invalid bitcode files can cause a crash, when OpNum exceeds
the number of elements in Record, like in the attached bitcode file.
The test case was generated by clusterfuzz: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15698
Reviewers: t.p.northover, thegameg, jfb
Reviewed By: jfb
Differential Revision: https://reviews.llvm.org/D64507
llvm-svn: 365750
Diffstat (limited to 'llvm/lib/Bitcode/Reader')
| -rw-r--r-- | llvm/lib/Bitcode/Reader/BitcodeReader.cpp | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/llvm/lib/Bitcode/Reader/BitcodeReader.cpp b/llvm/lib/Bitcode/Reader/BitcodeReader.cpp index 0ba76f0f371..0d302b7dfaa 100644 --- a/llvm/lib/Bitcode/Reader/BitcodeReader.cpp +++ b/llvm/lib/Bitcode/Reader/BitcodeReader.cpp @@ -4165,6 +4165,10 @@ Error BitcodeReader::parseFunctionBody(Function *F) { popValue(Record, OpNum, NextValueNo, LHS->getType(), RHS)) return error("Invalid record"); + if (OpNum >= Record.size()) + return error( + "Invalid record: operand number exceeded available operands"); + unsigned PredVal = Record[OpNum]; bool IsFP = LHS->getType()->isFPOrFPVectorTy(); FastMathFlags FMF; |
