From b42db1567c55a1d00ff7ecbe9abbbfba9a7d19cb Mon Sep 17 00:00:00 2001 From: Vlad Tsyrklevich Date: Fri, 27 Oct 2017 19:15:13 +0000 Subject: Fix llvm-special-case-list-fuzzer regexp exception Summary: Original oss-fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3727#c2 The minimized test case that causes this failure: 5b 5b 5b 3d 47 53 00 5b 3d 5d 5b 5d 0a [[[=GS.[=][]. Note the string "=GS\x00". The failure happens because the code is searching the string against an array of known collated names. "GS\x00" is a hit, but since len takes into account an extra NUL byte, indexing into cp->name[len] goes one byte past it's allocated memory. Fix this to use a strlen(cp->name) comparison to account for NUL bytes in the input. Reviewers: pcc Reviewed By: pcc Subscribers: hctim, kcc Differential Revision: https://reviews.llvm.org/D39380 llvm-svn: 316786 --- llvm/lib/Support/regcomp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'llvm/lib/Support/regcomp.c') diff --git a/llvm/lib/Support/regcomp.c b/llvm/lib/Support/regcomp.c index 6bf89c9cf1b..354e359f676 100644 --- a/llvm/lib/Support/regcomp.c +++ b/llvm/lib/Support/regcomp.c @@ -1008,7 +1008,7 @@ p_b_coll_elem(struct parse *p, { char *sp = p->next; struct cname *cp; - int len; + size_t len; while (MORE() && !SEETWO(endc, ']')) NEXT(); @@ -1018,7 +1018,7 @@ p_b_coll_elem(struct parse *p, } len = p->next - sp; for (cp = cnames; cp->name != NULL; cp++) - if (strncmp(cp->name, sp, len) == 0 && cp->name[len] == '\0') + if (strncmp(cp->name, sp, len) == 0 && strlen(cp->name) == len) return(cp->code); /* known name */ if (len == 1) return(*sp); /* single character */ -- cgit v1.2.3