From 3215b01bea5722f9e5940d395a88d1e49107811a Mon Sep 17 00:00:00 2001 From: David Korczynski Date: Tue, 26 Dec 2023 11:47:21 -0800 Subject: [PATCH 1/2] [BitcodeReader] Add bounds checking on Strtab This is needed to protect against global overflows, which was found by a fuzzer recently. Fixes: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65283 Signed-off-by: David Korczynski --- llvm/lib/Bitcode/Reader/BitcodeReader.cpp | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/llvm/lib/Bitcode/Reader/BitcodeReader.cpp b/llvm/lib/Bitcode/Reader/BitcodeReader.cpp index 8907f6fa4ff3f..77896f6f99d33 100644 --- a/llvm/lib/Bitcode/Reader/BitcodeReader.cpp +++ b/llvm/lib/Bitcode/Reader/BitcodeReader.cpp @@ -4218,6 +4218,10 @@ Error BitcodeReader::parseGlobalIndirectSymbolRecord( // Check whether we have enough values to read a partition name. if (OpNum + 1 < Record.size()) { + // Check Strtab has enough values for the partition. + if (Record[OpNum] + Record[OpNum + 1] > Strtab.size()) { + return error("Malformed partition, too large."); + } NewGA->setPartition( StringRef(Strtab.data() + Record[OpNum], Record[OpNum + 1])); OpNum += 2; From 0dc208d948798a6af5fae1d1fe5420b9d9d33115 Mon Sep 17 00:00:00 2001 From: David Korczynski Date: Tue, 26 Dec 2023 21:45:20 +0000 Subject: [PATCH 2/2] [BitcodeReader] fix style Signed-off-by: David Korczynski --- llvm/lib/Bitcode/Reader/BitcodeReader.cpp | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/llvm/lib/Bitcode/Reader/BitcodeReader.cpp b/llvm/lib/Bitcode/Reader/BitcodeReader.cpp index 77896f6f99d33..a027d0c21ba0b 100644 --- a/llvm/lib/Bitcode/Reader/BitcodeReader.cpp +++ b/llvm/lib/Bitcode/Reader/BitcodeReader.cpp @@ -4219,9 +4219,8 @@ Error BitcodeReader::parseGlobalIndirectSymbolRecord( // Check whether we have enough values to read a partition name. if (OpNum + 1 < Record.size()) { // Check Strtab has enough values for the partition. - if (Record[OpNum] + Record[OpNum + 1] > Strtab.size()) { + if (Record[OpNum] + Record[OpNum + 1] > Strtab.size()) return error("Malformed partition, too large."); - } NewGA->setPartition( StringRef(Strtab.data() + Record[OpNum], Record[OpNum + 1])); OpNum += 2;