From 34cccdaed7e7952a9191231ffa62b1b22eac35c8 Mon Sep 17 00:00:00 2001 From: Florian Hahn Date: Tue, 22 Jun 2021 14:48:45 +0100 Subject: [BitcodeReader] Validate Strtab before accessing. This fixes a crash with invalid bitcode files that have records referencing names in Strtab, but Strtab is not present or the index is out-of-bounds. This fixes the following clusterfuzz issue: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29895 Reviewed By: arsenm Differential Revision: https://reviews.llvm.org/D95554 --- llvm/lib/Bitcode/Reader/BitcodeReader.cpp | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) (limited to 'llvm/lib/Bitcode/Reader/BitcodeReader.cpp') diff --git a/llvm/lib/Bitcode/Reader/BitcodeReader.cpp b/llvm/lib/Bitcode/Reader/BitcodeReader.cpp index e002019..1631dc3 100644 --- a/llvm/lib/Bitcode/Reader/BitcodeReader.cpp +++ b/llvm/lib/Bitcode/Reader/BitcodeReader.cpp @@ -3407,9 +3407,12 @@ Error BitcodeReader::parseFunctionRecord(ArrayRef Record) { // Record[16] is the address space number. - // Check whether we have enough values to read a partition name. - if (Record.size() > 18) + // Check whether we have enough values to read a partition name. Also make + // sure Strtab has enough values. + if (Record.size() > 18 && Strtab.data() && + Record[17] + Record[18] <= Strtab.size()) { Func->setPartition(StringRef(Strtab.data() + Record[17], Record[18])); + } ValueList.push_back(Func); -- cgit v1.1