RPCS3/llvm-mirror
1
0
Fork 0
mirror of https://github.com/RPCS3/llvm-mirror.git synced 2025-01-10 05:41:40 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

[WebAssembly] Object: Add more error checking for object file reading

Browse Source 
This should address some the assert failures the fuzzer has been
finding such as:
  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=6719

Differential Revision: https://reviews.llvm.org/D47046

llvm-svn: 332769
This commit is contained in:
Sam Clegg 2018-05-18 21:08:26 +00:00
parent 0be1b838a4
commit b1eecd295e
1 changed files with 9 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
lib/Object/WasmObjectFile.cpp
View File

@ -112,19 +112,22 @@ static int64_t readLEB128(const uint8_t *&Ptr) {
static uint8_t readVaruint1(const uint8_t *&Ptr) {
int64_t result = readLEB128(Ptr);
assert(result <= VARUINT1_MAX && result >= 0);
if (result > VARUINT1_MAX || result < 0)
report_fatal_error("LEB is outside Varuint1 range");
return result;
}
static int32_t readVarint32(const uint8_t *&Ptr) {
int64_t result = readLEB128(Ptr);
assert(result <= INT32_MAX && result >= INT32_MIN);
if (result > INT32_MAX || result < INT32_MIN)
report_fatal_error("LEB is outside Varint32 range");
return result;
}
static uint32_t readVaruint32(const uint8_t *&Ptr) {
uint64_t result = readULEB128(Ptr);
assert(result <= UINT32_MAX);
if (result > UINT32_MAX)
report_fatal_error("LEB is outside Varuint32 range");
return result;
}
@ -955,6 +958,9 @@ Error WasmObjectFile::parseDataSection(const uint8_t *Ptr, const uint8_t *End) {
if (Error Err = readInitExpr(Segment.Data.Offset, Ptr))
return Err;
uint32_t Size = readVaruint32(Ptr);
if (Size > End - Ptr)
return make_error<GenericBinaryError>("Invalid segment size",
object_error::parse_failed);
Segment.Data.Content = ArrayRef<uint8_t>(Ptr, Size);
// The rest of these Data fields are set later, when reading in the linking
// metadata section.