diff options
| author | Vlad Tsyrklevich <vlad@tsyrklevich.net> | 2017-10-27 19:15:13 +0000 |
|---|---|---|
| committer | Vlad Tsyrklevich <vlad@tsyrklevich.net> | 2017-10-27 19:15:13 +0000 |
| commit | b42db1567c55a1d00ff7ecbe9abbbfba9a7d19cb (patch) | |
| tree | f84e2bc30109cf65c3bfb8da052dd0abdb250bd0 /llvm/lib/Support/regcomp.c | |
| parent | 92a2635bbd239ba2a239a3f081e30a8c3873b465 (diff) | |
| download | bcm5719-llvm-b42db1567c55a1d00ff7ecbe9abbbfba9a7d19cb.tar.gz bcm5719-llvm-b42db1567c55a1d00ff7ecbe9abbbfba9a7d19cb.zip | |
Fix llvm-special-case-list-fuzzer regexp exception
Summary:
Original oss-fuzz report:
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3727#c2
The minimized test case that causes this failure:
5b 5b 5b 3d 47 53 00 5b 3d 5d 5b 5d 0a [[[=GS.[=][].
Note the string "=GS\x00". The failure happens because the code is
searching the string against an array of known collated names. "GS\x00"
is a hit, but since len takes into account an extra NUL byte, indexing
into cp->name[len] goes one byte past it's allocated memory. Fix this to
use a strlen(cp->name) comparison to account for NUL bytes in the input.
Reviewers: pcc
Reviewed By: pcc
Subscribers: hctim, kcc
Differential Revision: https://reviews.llvm.org/D39380
llvm-svn: 316786
Diffstat (limited to 'llvm/lib/Support/regcomp.c')
| -rw-r--r-- | llvm/lib/Support/regcomp.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/llvm/lib/Support/regcomp.c b/llvm/lib/Support/regcomp.c index 6bf89c9cf1b..354e359f676 100644 --- a/llvm/lib/Support/regcomp.c +++ b/llvm/lib/Support/regcomp.c @@ -1008,7 +1008,7 @@ p_b_coll_elem(struct parse *p, { char *sp = p->next; struct cname *cp; - int len; + size_t len; while (MORE() && !SEETWO(endc, ']')) NEXT(); @@ -1018,7 +1018,7 @@ p_b_coll_elem(struct parse *p, } len = p->next - sp; for (cp = cnames; cp->name != NULL; cp++) - if (strncmp(cp->name, sp, len) == 0 && cp->name[len] == '\0') + if (strncmp(cp->name, sp, len) == 0 && strlen(cp->name) == len) return(cp->code); /* known name */ if (len == 1) return(*sp); /* single character */ |
