From fcd044b692653de5e79502e556cb652b8867b77f Mon Sep 17 00:00:00 2001 From: Filipe Cabecinhas Date: Fri, 30 Jan 2015 18:13:50 +0000 Subject: Check bit widths before trying to get a type. Added a test case for it. Also added run lines for the test case in r227566. Bugs found with afl-fuzz llvm-svn: 227589 --- llvm/lib/Bitcode/Reader/BitcodeReader.cpp | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) (limited to 'llvm/lib/Bitcode/Reader/BitcodeReader.cpp') diff --git a/llvm/lib/Bitcode/Reader/BitcodeReader.cpp b/llvm/lib/Bitcode/Reader/BitcodeReader.cpp index c3589bc..0af344a 100644 --- a/llvm/lib/Bitcode/Reader/BitcodeReader.cpp +++ b/llvm/lib/Bitcode/Reader/BitcodeReader.cpp @@ -950,12 +950,17 @@ std::error_code BitcodeReader::ParseTypeTableBody() { case bitc::TYPE_CODE_X86_MMX: // X86_MMX ResultTy = Type::getX86_MMXTy(Context); break; - case bitc::TYPE_CODE_INTEGER: // INTEGER: [width] + case bitc::TYPE_CODE_INTEGER: { // INTEGER: [width] if (Record.size() < 1) return Error("Invalid record"); - ResultTy = IntegerType::get(Context, Record[0]); + uint64_t NumBits = Record[0]; + if (NumBits < IntegerType::MIN_INT_BITS || + NumBits > IntegerType::MAX_INT_BITS) + return Error("Bitwidth for integer type out of range"); + ResultTy = IntegerType::get(Context, NumBits); break; + } case bitc::TYPE_CODE_POINTER: { // POINTER: [pointee type] or // [pointee type, address space] if (Record.size() < 1) -- cgit v1.1