RPCS3/llvm-mirror
1
0
Fork 0
mirror of https://github.com/RPCS3/llvm-mirror.git synced 2024-11-29 22:30:33 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Make sure we don't resize(0) when we get a fwdref with Idx == UINT_MAX

Browse Source 
Make it an error instead.

Bug found with AFL fuzz.

llvm-svn: 236190
This commit is contained in:
Filipe Cabecinhas 2015-04-30 00:52:42 +00:00
parent f4d8e72cec
commit c8f68a05d1
3 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
lib/Bitcode/Reader/BitcodeReader.cpp
View File

@ -790,6 +790,10 @@ Constant *BitcodeReaderValueList::getConstantFwdRef(unsigned Idx,
}
Value *BitcodeReaderValueList::getValueFwdRef(unsigned Idx, Type *Ty) {
// Bail out for a clearly invalid value. This would make us call resize(0)
if (Idx == UINT_MAX)
return nullptr;
if (Idx >= size())
resize(Idx + 1);

BIN
test/Bitcode/Inputs/invalid-too-big-fwdref.bc Normal file
View File

Binary file not shown.

5
test/Bitcode/invalid.test
View File

@ -112,3 +112,8 @@ RUN: not llvm-dis -disable-output %p/Inputs/invalid-array-op-not-2nd-to-last.bc
RUN: FileCheck --check-prefix=ARRAY-NOT-2LAST %s
ARRAY-NOT-2LAST: Array op not second to last
RUN: not llvm-dis -disable-output %p/Inputs/invalid-too-big-fwdref.bc 2>&1 | \
RUN: FileCheck --check-prefix=HUGE-FWDREF %s
HUGE-FWDREF: Invalid record