[llvm-bugs] [Bug 46958] New: Out of boundary read in Unwind-EHABI.cpp

[via llvm-bugs]

https://bugs.llvm.org/show_bug.cgi?id=46958

            Bug ID: 46958
           Summary: Out of boundary read in Unwind-EHABI.cpp
           Product: Runtime Libraries
           Version: trunk
          Hardware: PC
                OS: All
            Status: NEW
          Severity: normal
          Priority: P
         Component: libunwind
          Assignee: unassignedbugs at nondot.org
          Reporter: leadroyal at qq.com
                CC: llvm-bugs at lists.llvm.org

File: llvm/llvm-project/blob/master/libunwind/src/Unwind-EHABI.cpp
Function: _Unwind_VRS_Interpret

Length of one bytecode can be 1 or 2 or more. There has been a boundary check
during interpreting in some of them, but still forget the others.

For example:


Intercept with check:

```
            case 0xb1: {
              if (offset >= len)
                return _URC_FAILURE;
              uint8_t registers = getByte(data, offset++);
              if (registers & 0xf0 || !registers)
                return _URC_FAILURE;
              _Unwind_VRS_Pop(context, _UVRSC_CORE, registers, _UVRSD_UINT32);
              break;
            }

```

Intercept without check:

```
            case 0xb3: {
              uint8_t v = getByte(data, offset++);
              _Unwind_VRS_Pop(context, _UVRSC_VFP,
                              RegisterRange(static_cast<uint8_t>(v >> 4),
                                            v & 0x0f), _UVRSD_VFPX);
              break;
            }
```

I think case 0xb3 needs a boundary check. The same situation: 0xc6, 0xc7, 0xc8,
0xc9.

-- 
You are receiving this mail because:
You are on the CC list for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/llvm-bugs/attachments/20200802/c6644ef9/attachment-0001.html>