From 8511777d3a41e5198a7028711754d3e9c29afddc Mon Sep 17 00:00:00 2001 From: Jonas Devlieghere Date: Wed, 8 Aug 2018 16:34:03 +0000 Subject: [WASM] Fix overflow when reading custom section When reading a custom WASM section, it was possible that its name extended beyond the size of the section. This resulted in a bogus value for the section size due to the size overflowing. Fixes heap buffer overflow detected by OSS-fuzz: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=8190 Differential revision: https://reviews.llvm.org/D50387 llvm-svn: 339269 --- llvm/lib/Object/WasmObjectFile.cpp | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) (limited to 'llvm/lib') diff --git a/llvm/lib/Object/WasmObjectFile.cpp b/llvm/lib/Object/WasmObjectFile.cpp index 4d4c887b2d9..1b32ae8afd9 100644 --- a/llvm/lib/Object/WasmObjectFile.cpp +++ b/llvm/lib/Object/WasmObjectFile.cpp @@ -216,9 +216,16 @@ static Error readSection(WasmSection &Section, return make_error("Section too large", object_error::parse_failed); if (Section.Type == wasm::WASM_SEC_CUSTOM) { - const uint8_t *NameStart = Ctx.Ptr; - Section.Name = readString(Ctx); - Size -= Ctx.Ptr - NameStart; + WasmObjectFile::ReadContext SectionCtx; + SectionCtx.Start = Ctx.Ptr; + SectionCtx.Ptr = Ctx.Ptr; + SectionCtx.End = Ctx.Ptr + Size; + + Section.Name = readString(SectionCtx); + + uint32_t SectionNameSize = SectionCtx.Ptr - SectionCtx.Start; + Ctx.Ptr += SectionNameSize; + Size -= SectionNameSize; } Section.Content = ArrayRef(Ctx.Ptr, Size); Ctx.Ptr += Size; -- cgit v1.2.3