From: Filipe Cabecinhas <me@filcab.net>
Date: Thu, 30 Apr 2015 00:52:42 +0000 (+0000)
Subject: Make sure we don't resize(0) when we get a fwdref with Idx == UINT_MAX
X-Git-Url: http://demsky.eecs.uci.edu/git/?a=commitdiff_plain;h=a607be94caf73ac9001f2cc01bae6298d76b29ae;p=oota-llvm.git

Make sure we don't resize(0) when we get a fwdref with Idx == UINT_MAX

Make it an error instead.

Bug found with AFL fuzz.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@236190 91177308-0d34-0410-b5e6-96231b3b80d8
---

diff --git a/lib/Bitcode/Reader/BitcodeReader.cpp b/lib/Bitcode/Reader/BitcodeReader.cpp
index f49a53805c9..7778125e2d4 100644
--- a/lib/Bitcode/Reader/BitcodeReader.cpp
+++ b/lib/Bitcode/Reader/BitcodeReader.cpp
@@ -790,6 +790,10 @@ Constant *BitcodeReaderValueList::getConstantFwdRef(unsigned Idx,
 }
 
 Value *BitcodeReaderValueList::getValueFwdRef(unsigned Idx, Type *Ty) {
+  // Bail out for a clearly invalid value. This would make us call resize(0)
+  if (Idx == UINT_MAX)
+    return nullptr;
+
   if (Idx >= size())
     resize(Idx + 1);
 
diff --git a/test/Bitcode/Inputs/invalid-too-big-fwdref.bc b/test/Bitcode/Inputs/invalid-too-big-fwdref.bc
new file mode 100644
index 00000000000..d1d51a634fc
Binary files /dev/null and b/test/Bitcode/Inputs/invalid-too-big-fwdref.bc differ
diff --git a/test/Bitcode/invalid.test b/test/Bitcode/invalid.test
index c18ff3d3f61..077f3515128 100644
--- a/test/Bitcode/invalid.test
+++ b/test/Bitcode/invalid.test
@@ -112,3 +112,8 @@ RUN: not llvm-dis -disable-output %p/Inputs/invalid-array-op-not-2nd-to-last.bc
 RUN:   FileCheck --check-prefix=ARRAY-NOT-2LAST %s
 
 ARRAY-NOT-2LAST: Array op not second to last
+
+RUN: not llvm-dis -disable-output %p/Inputs/invalid-too-big-fwdref.bc 2>&1 | \
+RUN:   FileCheck --check-prefix=HUGE-FWDREF %s
+
+HUGE-FWDREF: Invalid record