From ae0b2633c935950084860e5f6a1c2c3203726489 Mon Sep 17 00:00:00 2001 From: DavidKorczynski Date: Wed, 27 Dec 2023 08:26:21 +0000 Subject: [BitcodeReader] Add bounds checking on Strtab (#76403) This is needed to protect against global overflows, which was found by a fuzzer recently. Fixes: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65283 --------- Signed-off-by: David Korczynski --- llvm/lib/Bitcode/Reader/BitcodeReader.cpp | 3 +++ 1 file changed, 3 insertions(+) (limited to 'llvm/lib/Bitcode/Reader/BitcodeReader.cpp') diff --git a/llvm/lib/Bitcode/Reader/BitcodeReader.cpp b/llvm/lib/Bitcode/Reader/BitcodeReader.cpp index 8907f6f..a027d0c 100644 --- a/llvm/lib/Bitcode/Reader/BitcodeReader.cpp +++ b/llvm/lib/Bitcode/Reader/BitcodeReader.cpp @@ -4218,6 +4218,9 @@ Error BitcodeReader::parseGlobalIndirectSymbolRecord( // Check whether we have enough values to read a partition name. if (OpNum + 1 < Record.size()) { + // Check Strtab has enough values for the partition. + if (Record[OpNum] + Record[OpNum + 1] > Strtab.size()) + return error("Malformed partition, too large."); NewGA->setPartition( StringRef(Strtab.data() + Record[OpNum], Record[OpNum + 1])); OpNum += 2; -- cgit v1.1