From: Filipe Cabecinhas <me@filcab.net>
Date: Tue, 28 Apr 2015 20:18:47 +0000 (+0000)
Subject: Relax an assert when there's a type mismatch in forward references
X-Git-Url: http://demsky.eecs.uci.edu/git/?a=commitdiff_plain;h=7acbf5611216bedb1063ebf2d92c8fd5e4ca782d;p=oota-llvm.git

Relax an assert when there's a type mismatch in forward references

Summary:
We don't seem to need to assert here, since this function's callers expect
to get a nullptr on error. This way we don't assert on user input.

Bug found with AFL fuzz.

Reviewers: rafael

Subscribers: llvm-commits

Differential Revision: http://reviews.llvm.org/D9308

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@236027 91177308-0d34-0410-b5e6-96231b3b80d8
---

diff --git a/lib/Bitcode/Reader/BitcodeReader.cpp b/lib/Bitcode/Reader/BitcodeReader.cpp
index 35e98c01760..6656478754e 100644
--- a/lib/Bitcode/Reader/BitcodeReader.cpp
+++ b/lib/Bitcode/Reader/BitcodeReader.cpp
@@ -794,7 +794,9 @@ Value *BitcodeReaderValueList::getValueFwdRef(unsigned Idx, Type *Ty) {
     resize(Idx + 1);
 
   if (Value *V = ValuePtrs[Idx]) {
-    assert((!Ty || Ty == V->getType()) && "Type mismatch in value table!");
+    // If the types don't match, it's invalid.
+    if (Ty && Ty != V->getType())
+      return nullptr;
     return V;
   }
 
diff --git a/test/Bitcode/Inputs/invalid-fwdref-type-mismatch.bc b/test/Bitcode/Inputs/invalid-fwdref-type-mismatch.bc
new file mode 100644
index 00000000000..d1c9560257a
Binary files /dev/null and b/test/Bitcode/Inputs/invalid-fwdref-type-mismatch.bc differ
diff --git a/test/Bitcode/invalid.test b/test/Bitcode/invalid.test
index 0bed40b238f..89cd0e908f0 100644
--- a/test/Bitcode/invalid.test
+++ b/test/Bitcode/invalid.test
@@ -93,3 +93,8 @@ RUN: not llvm-dis -disable-output %p/Inputs/invalid-non-vector-shufflevector.bc
 RUN:   FileCheck --check-prefix=INVALID-TYPE %s
 
 INVALID-TYPE: Invalid type for value
+
+RUN: not llvm-dis -disable-output %p/Inputs/invalid-fwdref-type-mismatch.bc 2>&1 | \
+RUN:   FileCheck --check-prefix=FWDREF-TYPE %s
+
+FWDREF-TYPE: Invalid record