From 7b30f32d3d4d0b43a8f41e0b960a70fe412a6065 Mon Sep 17 00:00:00 2001
From: Filipe Cabecinhas <me@filcab.net>
Date: Wed, 29 Apr 2015 01:58:31 +0000
Subject: [PATCH] Turn an assert into report_fatal_error since it's reachable
 based on user input

Bug found with AFL fuzz.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@236076 91177308-0d34-0410-b5e6-96231b3b80d8
---
 lib/Bitcode/Reader/BitstreamReader.cpp            |   3 ++-
 .../Inputs/invalid-array-op-not-2nd-to-last.bc    | Bin 0 -> 452 bytes
 test/Bitcode/invalid.test                         |   5 +++++
 3 files changed, 7 insertions(+), 1 deletion(-)
 create mode 100644 test/Bitcode/Inputs/invalid-array-op-not-2nd-to-last.bc

diff --git a/lib/Bitcode/Reader/BitstreamReader.cpp b/lib/Bitcode/Reader/BitstreamReader.cpp
index 2f34532ae93..dff6d181486 100644
--- a/lib/Bitcode/Reader/BitstreamReader.cpp
+++ b/lib/Bitcode/Reader/BitstreamReader.cpp
@@ -199,7 +199,8 @@ unsigned BitstreamCursor::readRecord(unsigned AbbrevID,
       unsigned NumElts = ReadVBR(6);
 
       // Get the element encoding.
-      assert(i+2 == e && "array op not second to last?");
+      if (i+2 != e)
+       report_fatal_error("Array op not second to last");
       const BitCodeAbbrevOp &EltEnc = Abbv->getOperandInfo(++i);
       if (EltEnc.getEncoding() == BitCodeAbbrevOp::Array ||
           EltEnc.getEncoding() == BitCodeAbbrevOp::Blob)
diff --git a/test/Bitcode/Inputs/invalid-array-op-not-2nd-to-last.bc b/test/Bitcode/Inputs/invalid-array-op-not-2nd-to-last.bc
new file mode 100644
index 0000000000000000000000000000000000000000..a4b94f8213df565908686da62f67a455845cead0
GIT binary patch
literal 452
zcmZ>AK5$Qwhk+rFfq{X$Nr8b0NDBcmd!zD1#}h1`Yyw7>lNeigR9QJB<yg9t8U$RK
zoF;KQwFnrASa3*qav8a(cyLWnR6Y{az$2+xq{4oJLojK@f)x(OJ}@!}Fmx&~Fz^G-
zGg9K<R7h!M5ms8#A}Fl%xMkr45h0(B9`2SF9{~ephGG^EAs3+&GK>;u7$h1`v4n9<
zuso!6U;@ZJ&Qn-`BoIg}(t$7><k)}=K_E8fXplMbP$um=qiu(?Ma$tHrv~=Q3ijd|
zg)+|=_}>cfeQDq`=5dlcbWrx(LYXuJR<N>W=`+l>C!B42m~DY(G%GMLfXoxypwR2$
z63nV2lE}bQ=qsq;Bf22~Xmuh`UJWQO%yKZ}5JQg|&%q34MwZ3AECLA@OM&8CK+GN>
za8@KyO(AA0FURy;mP4h{jDmtexoj>j9@}IE1QqYLIk>d6FauRW%mcYyn8i^?07!%U
sD5A_@Vhp4=3pRs@LqN~+fqV^e7sPCBpxL58ldh%#O-g~71e62<0LUn0IRF3v

literal 0
HcmV?d00001

diff --git a/test/Bitcode/invalid.test b/test/Bitcode/invalid.test
index 6dfab58375e..41173d17e5d 100644
--- a/test/Bitcode/invalid.test
+++ b/test/Bitcode/invalid.test
@@ -105,3 +105,8 @@ RUN: not llvm-dis -disable-output %p/Inputs/invalid-vector-element-type.bc 2>&1
 RUN:   FileCheck --check-prefix=ELEMENT-TYPE %s
 
 ELEMENT-TYPE: Invalid type
+
+RUN: not llvm-dis -disable-output %p/Inputs/invalid-array-op-not-2nd-to-last.bc 2>&1 | \
+RUN:   FileCheck --check-prefix=ARRAY-NOT-2LAST %s
+
+ARRAY-NOT-2LAST: Array op not second to last
-- 
2.34.1