From: Filipe Cabecinhas <me@filcab.net>
Date: Thu, 30 Apr 2015 04:09:41 +0000 (+0000)
Subject: Don't overflow GCTable
X-Git-Url: http://demsky.eecs.uci.edu/git/?a=commitdiff_plain;h=deedba2a369a693905c467b805449a3109fca6c7;p=oota-llvm.git

Don't overflow GCTable

Summary: Bug found with AFL fuzz.

Reviewers: rafael, dexonsmith

Subscribers: llvm-commits

Differential Revision: http://reviews.llvm.org/D9361

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@236200 91177308-0d34-0410-b5e6-96231b3b80d8
---

diff --git a/lib/Bitcode/Reader/BitcodeReader.cpp b/lib/Bitcode/Reader/BitcodeReader.cpp
index 456df6dab8e..aed1196f3ce 100644
--- a/lib/Bitcode/Reader/BitcodeReader.cpp
+++ b/lib/Bitcode/Reader/BitcodeReader.cpp
@@ -2992,7 +2992,7 @@ std::error_code BitcodeReader::ParseModule(bool Resume,
         // FIXME: Change to an error if non-default in 4.0.
         Func->setVisibility(GetDecodedVisibility(Record[7]));
       if (Record.size() > 8 && Record[8]) {
-        if (Record[8]-1 > GCTable.size())
+        if (Record[8]-1 >= GCTable.size())
           return Error("Invalid ID");
         Func->setGC(GCTable[Record[8]-1].c_str());
       }
diff --git a/test/Bitcode/Inputs/invalid-GCTable-overflow.bc b/test/Bitcode/Inputs/invalid-GCTable-overflow.bc
new file mode 100644
index 00000000000..a9e9c52e1c0
Binary files /dev/null and b/test/Bitcode/Inputs/invalid-GCTable-overflow.bc differ
diff --git a/test/Bitcode/invalid.test b/test/Bitcode/invalid.test
index 4aff5c00501..2fe77989b2a 100644
--- a/test/Bitcode/invalid.test
+++ b/test/Bitcode/invalid.test
@@ -122,3 +122,8 @@ RUN: not llvm-dis -disable-output %p/Inputs/invalid-load-pointer-type.bc 2>&1 |
 RUN:   FileCheck --check-prefix=LOAD-BAD-TYPE %s
 
 LOAD-BAD-TYPE: Load operand is not a pointer type
+
+RUN: not llvm-dis -disable-output %p/Inputs/invalid-GCTable-overflow.bc 2>&1 | \
+RUN:   FileCheck --check-prefix=GCTABLE-OFLOW %s
+
+GCTABLE-OFLOW: Invalid ID