RPCS3/llvm
1
0
Fork 0
mirror of https://github.com/RPCS3/llvm.git synced 2025-01-19 08:24:12 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

[wasm] readSection: Avoid reading past eof (fixes oss-fuzz #3219)

Browse Source 
A wasm file crafted with a bogus section size can trigger an ASan issue
in the DWARFObjInMemory constructor. Nip the problem in the bud when we
read the wasm section.

Found by OSS-Fuzz:
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3219

Differential Revision: https://reviews.llvm.org/D38777

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@316357 91177308-0d34-0410-b5e6-96231b3b80d8
This commit is contained in:
Vedant Kumar 2017-10-23 18:04:34 +00:00
parent 3e1218f32a
commit f9ce75bf18
3 changed files with 7 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
lib/Object/WasmObjectFile.cpp
View File

@ -178,14 +178,16 @@ static wasm::WasmTable readTable(const uint8_t *&Ptr) {
}
static Error readSection(WasmSection &Section, const uint8_t *&Ptr,
const uint8_t *Start) {
// TODO(sbc): Avoid reading past EOF in the case of malformed files.
const uint8_t *Start, const uint8_t *Eof) {
Section.Offset = Ptr - Start;
Section.Type = readVaruint7(Ptr);
uint32_t Size = readVaruint32(Ptr);
if (Size == 0)
return make_error<StringError>("Zero length section",
object_error::parse_failed);
if (Ptr + Size > Eof)
return make_error<StringError>("Section too large",
object_error::parse_failed);
Section.Content = ArrayRef<uint8_t>(Ptr, Size);
Ptr += Size;
return Error::success();
@ -221,7 +223,7 @@ WasmObjectFile::WasmObjectFile(MemoryBufferRef Buffer, Error &Err)
WasmSection Sec;
while (Ptr < Eof) {
if ((Err = readSection(Sec, Ptr, getPtr(0))))
if ((Err = readSection(Sec, Ptr, getPtr(0), Eof)))
return;
if ((Err = parseSection(Sec)))
return;

BIN
test/tools/llvm-objdump/Inputs/corrupt-section.wasm Normal file
View File

Binary file not shown.

2
test/tools/llvm-objdump/wasm-corrupt-section.test Normal file
View File

@ -0,0 +1,2 @@
# RUN: not llvm-objdump -h %p/Inputs/corrupt-section.wasm 2>&1 | FileCheck %s
# CHECK: '{{.*}}corrupt-section.wasm': Section too large