RPCS3/llvm-mirror
1
0
Fork 0
mirror of https://github.com/RPCS3/llvm-mirror.git synced 2024-11-29 22:30:33 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

[Bitcode reader] Fix a few assertions when reading invalid files

Browse Source 
Summary:
When creating {insert,extract}value instructions from a BitcodeReader, we
weren't verifying the fields were valid.

Bugs found with afl-fuzz

Reviewers: rafael

Subscribers: llvm-commits

Differential Revision: http://reviews.llvm.org/D7325

llvm-svn: 229345
This commit is contained in:
Filipe Cabecinhas 2015-02-16 00:03:11 +00:00
parent dbb9827d2f
commit e4564d63bb
8 changed files with 53 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
lib/Bitcode/Reader/BitcodeReader.cpp
View File

@ -3065,12 +3065,27 @@ std::error_code BitcodeReader::ParseFunctionBody(Function *F) {
return Error("Invalid record");
SmallVector<unsigned, 4> EXTRACTVALIdx;
Type *CurTy = Agg->getType();
for (unsigned RecSize = Record.size();
OpNum != RecSize; ++OpNum) {
bool IsArray = CurTy->isArrayTy();
bool IsStruct = CurTy->isStructTy();
uint64_t Index = Record[OpNum];
if (!IsStruct && !IsArray)
return Error("EXTRACTVAL: Invalid type");
if ((unsigned)Index != Index)
return Error("Invalid value");
if (IsStruct && Index >= CurTy->subtypes().size())
return Error("EXTRACTVAL: Invalid struct index");
if (IsArray && Index >= CurTy->getArrayNumElements())
return Error("EXTRACTVAL: Invalid array index");
EXTRACTVALIdx.push_back((unsigned)Index);
if (IsStruct)
CurTy = CurTy->subtypes()[Index];
else
CurTy = CurTy->subtypes()[0];
}
I = ExtractValueInst::Create(Agg, EXTRACTVALIdx);
@ -3089,12 +3104,29 @@ std::error_code BitcodeReader::ParseFunctionBody(Function *F) {
return Error("Invalid record");
SmallVector<unsigned, 4> INSERTVALIdx;
Type *CurTy = Agg->getType();
for (unsigned RecSize = Record.size();
OpNum != RecSize; ++OpNum) {
bool IsArray = CurTy->isArrayTy();
bool IsStruct = CurTy->isStructTy();
uint64_t Index = Record[OpNum];
if (!IsStruct && !IsArray)
return Error("INSERTVAL: Invalid type");
if (!CurTy->isStructTy() && !CurTy->isArrayTy())
return Error("Invalid type");
if ((unsigned)Index != Index)
return Error("Invalid value");
if (IsStruct && Index >= CurTy->subtypes().size())
return Error("INSERTVAL: Invalid struct index");
if (IsArray && Index >= CurTy->getArrayNumElements())
return Error("INSERTVAL: Invalid array index");
INSERTVALIdx.push_back((unsigned)Index);
if (IsStruct)
CurTy = CurTy->subtypes()[Index];
else
CurTy = CurTy->subtypes()[0];
}
I = InsertValueInst::Create(Agg, Val, INSERTVALIdx);

BIN
test/Bitcode/Inputs/invalid-extractval-array-idx.bc Normal file
View File

Binary file not shown.

BIN
test/Bitcode/Inputs/invalid-extractval-struct-idx.bc Normal file
View File

Binary file not shown.

BIN
test/Bitcode/Inputs/invalid-extractval-too-many-idxs.bc Normal file
View File

Binary file not shown.

BIN
test/Bitcode/Inputs/invalid-insertval-array-idx.bc Normal file
View File

Binary file not shown.

BIN
test/Bitcode/Inputs/invalid-insertval-struct-idx.bc Normal file
View File

Binary file not shown.

BIN
test/Bitcode/Inputs/invalid-insertval-too-many-idxs.bc Normal file
View File

Binary file not shown.

21
test/Bitcode/invalid.test
View File

@ -17,3 +17,24 @@ UNEXPECTED-EOF: Unexpected end of file
BAD-ABBREV-NUMBER: Invalid abbrev number
BAD-TYPE-TABLE-FORWARD-REF: Invalid TYPE table: Only named structs can be forward referenced
BAD-BITWIDTH: Bitwidth for integer type out of range
RUN: not llvm-dis -disable-output %p/Inputs/invalid-extractval-array-idx.bc 2>&1 | \
RUN: FileCheck --check-prefix=EXTRACT-ARRAY %s
RUN: not llvm-dis -disable-output %p/Inputs/invalid-extractval-struct-idx.bc 2>&1 | \
RUN: FileCheck --check-prefix=EXTRACT-STRUCT %s
RUN: not llvm-dis -disable-output %p/Inputs/invalid-extractval-too-many-idxs.bc 2>&1 | \
RUN: FileCheck --check-prefix=EXTRACT-IDXS %s
RUN: not llvm-dis -disable-output %p/Inputs/invalid-insertval-array-idx.bc 2>&1 | \
RUN: FileCheck --check-prefix=INSERT-ARRAY %s
RUN: not llvm-dis -disable-output %p/Inputs/invalid-insertval-struct-idx.bc 2>&1 | \
RUN: FileCheck --check-prefix=INSERT-STRUCT %s
RUN: not llvm-dis -disable-output %p/Inputs/invalid-insertval-too-many-idxs.bc 2>&1 | \
RUN: FileCheck --check-prefix=INSERT-IDXS %s
EXTRACT-ARRAY: EXTRACTVAL: Invalid array index
EXTRACT-STRUCT: EXTRACTVAL: Invalid struct index
EXTRACT-IDXS: EXTRACTVAL: Invalid type
INSERT-ARRAY: INSERTVAL: Invalid array index
INSERT-STRUCT: INSERTVAL: Invalid struct index
INSERT-IDXS: INSERTVAL: Invalid type