From: Filipe Cabecinhas Date: Mon, 16 Feb 2015 00:03:11 +0000 (+0000) Subject: [Bitcode reader] Fix a few assertions when reading invalid files X-Git-Url: http://demsky.eecs.uci.edu/git/?a=commitdiff_plain;h=9183d13f45cad8af7f5cd5eb65056f14db2bab95;p=oota-llvm.git [Bitcode reader] Fix a few assertions when reading invalid files Summary: When creating {insert,extract}value instructions from a BitcodeReader, we weren't verifying the fields were valid. Bugs found with afl-fuzz Reviewers: rafael Subscribers: llvm-commits Differential Revision: http://reviews.llvm.org/D7325 git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@229345 91177308-0d34-0410-b5e6-96231b3b80d8 --- diff --git a/lib/Bitcode/Reader/BitcodeReader.cpp b/lib/Bitcode/Reader/BitcodeReader.cpp index 92a1dcce5bb..4fe054de370 100644 --- a/lib/Bitcode/Reader/BitcodeReader.cpp +++ b/lib/Bitcode/Reader/BitcodeReader.cpp @@ -3065,12 +3065,27 @@ std::error_code BitcodeReader::ParseFunctionBody(Function *F) { return Error("Invalid record"); SmallVector EXTRACTVALIdx; + Type *CurTy = Agg->getType(); for (unsigned RecSize = Record.size(); OpNum != RecSize; ++OpNum) { + bool IsArray = CurTy->isArrayTy(); + bool IsStruct = CurTy->isStructTy(); uint64_t Index = Record[OpNum]; + + if (!IsStruct && !IsArray) + return Error("EXTRACTVAL: Invalid type"); if ((unsigned)Index != Index) return Error("Invalid value"); + if (IsStruct && Index >= CurTy->subtypes().size()) + return Error("EXTRACTVAL: Invalid struct index"); + if (IsArray && Index >= CurTy->getArrayNumElements()) + return Error("EXTRACTVAL: Invalid array index"); EXTRACTVALIdx.push_back((unsigned)Index); + + if (IsStruct) + CurTy = CurTy->subtypes()[Index]; + else + CurTy = CurTy->subtypes()[0]; } I = ExtractValueInst::Create(Agg, EXTRACTVALIdx); @@ -3089,12 +3104,29 @@ std::error_code BitcodeReader::ParseFunctionBody(Function *F) { return Error("Invalid record"); SmallVector INSERTVALIdx; + Type *CurTy = Agg->getType(); for (unsigned RecSize = Record.size(); OpNum != RecSize; ++OpNum) { + bool IsArray = CurTy->isArrayTy(); + bool IsStruct = CurTy->isStructTy(); uint64_t Index = Record[OpNum]; + + if (!IsStruct && !IsArray) + return Error("INSERTVAL: Invalid type"); + if (!CurTy->isStructTy() && !CurTy->isArrayTy()) + return Error("Invalid type"); if ((unsigned)Index != Index) return Error("Invalid value"); + if (IsStruct && Index >= CurTy->subtypes().size()) + return Error("INSERTVAL: Invalid struct index"); + if (IsArray && Index >= CurTy->getArrayNumElements()) + return Error("INSERTVAL: Invalid array index"); + INSERTVALIdx.push_back((unsigned)Index); + if (IsStruct) + CurTy = CurTy->subtypes()[Index]; + else + CurTy = CurTy->subtypes()[0]; } I = InsertValueInst::Create(Agg, Val, INSERTVALIdx); diff --git a/test/Bitcode/Inputs/invalid-extractval-array-idx.bc b/test/Bitcode/Inputs/invalid-extractval-array-idx.bc new file mode 100644 index 00000000000..7465df361c0 Binary files /dev/null and b/test/Bitcode/Inputs/invalid-extractval-array-idx.bc differ diff --git a/test/Bitcode/Inputs/invalid-extractval-struct-idx.bc b/test/Bitcode/Inputs/invalid-extractval-struct-idx.bc new file mode 100644 index 00000000000..ccb40f7ebce Binary files /dev/null and b/test/Bitcode/Inputs/invalid-extractval-struct-idx.bc differ diff --git a/test/Bitcode/Inputs/invalid-extractval-too-many-idxs.bc b/test/Bitcode/Inputs/invalid-extractval-too-many-idxs.bc new file mode 100644 index 00000000000..543a3ba7131 Binary files /dev/null and b/test/Bitcode/Inputs/invalid-extractval-too-many-idxs.bc differ diff --git a/test/Bitcode/Inputs/invalid-insertval-array-idx.bc b/test/Bitcode/Inputs/invalid-insertval-array-idx.bc new file mode 100644 index 00000000000..79c3c038a1c Binary files /dev/null and b/test/Bitcode/Inputs/invalid-insertval-array-idx.bc differ diff --git a/test/Bitcode/Inputs/invalid-insertval-struct-idx.bc b/test/Bitcode/Inputs/invalid-insertval-struct-idx.bc new file mode 100644 index 00000000000..ec70384909a Binary files /dev/null and b/test/Bitcode/Inputs/invalid-insertval-struct-idx.bc differ diff --git a/test/Bitcode/Inputs/invalid-insertval-too-many-idxs.bc b/test/Bitcode/Inputs/invalid-insertval-too-many-idxs.bc new file mode 100644 index 00000000000..fd21ac24cf4 Binary files /dev/null and b/test/Bitcode/Inputs/invalid-insertval-too-many-idxs.bc differ diff --git a/test/Bitcode/invalid.test b/test/Bitcode/invalid.test index 3eaa0394dba..84bc9278d91 100644 --- a/test/Bitcode/invalid.test +++ b/test/Bitcode/invalid.test @@ -17,3 +17,24 @@ UNEXPECTED-EOF: Unexpected end of file BAD-ABBREV-NUMBER: Invalid abbrev number BAD-TYPE-TABLE-FORWARD-REF: Invalid TYPE table: Only named structs can be forward referenced BAD-BITWIDTH: Bitwidth for integer type out of range + +RUN: not llvm-dis -disable-output %p/Inputs/invalid-extractval-array-idx.bc 2>&1 | \ +RUN: FileCheck --check-prefix=EXTRACT-ARRAY %s +RUN: not llvm-dis -disable-output %p/Inputs/invalid-extractval-struct-idx.bc 2>&1 | \ +RUN: FileCheck --check-prefix=EXTRACT-STRUCT %s +RUN: not llvm-dis -disable-output %p/Inputs/invalid-extractval-too-many-idxs.bc 2>&1 | \ +RUN: FileCheck --check-prefix=EXTRACT-IDXS %s +RUN: not llvm-dis -disable-output %p/Inputs/invalid-insertval-array-idx.bc 2>&1 | \ +RUN: FileCheck --check-prefix=INSERT-ARRAY %s +RUN: not llvm-dis -disable-output %p/Inputs/invalid-insertval-struct-idx.bc 2>&1 | \ +RUN: FileCheck --check-prefix=INSERT-STRUCT %s +RUN: not llvm-dis -disable-output %p/Inputs/invalid-insertval-too-many-idxs.bc 2>&1 | \ +RUN: FileCheck --check-prefix=INSERT-IDXS %s + + +EXTRACT-ARRAY: EXTRACTVAL: Invalid array index +EXTRACT-STRUCT: EXTRACTVAL: Invalid struct index +EXTRACT-IDXS: EXTRACTVAL: Invalid type +INSERT-ARRAY: INSERTVAL: Invalid array index +INSERT-STRUCT: INSERTVAL: Invalid struct index +INSERT-IDXS: INSERTVAL: Invalid type