<html>
<head>
<base href="https://llvm.org/bugs/" />
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW --- - heap-buffer-overflow in llvm::InlineAsm::ConstraintInfo::Parse"
href="https://llvm.org/bugs/show_bug.cgi?id=24661">24661</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>heap-buffer-overflow in llvm::InlineAsm::ConstraintInfo::Parse
</td>
</tr>
<tr>
<th>Product</th>
<td>new-bugs
</td>
</tr>
<tr>
<th>Version</th>
<td>unspecified
</td>
</tr>
<tr>
<th>Hardware</th>
<td>PC
</td>
</tr>
<tr>
<th>OS</th>
<td>Linux
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>normal
</td>
</tr>
<tr>
<th>Priority</th>
<td>P
</td>
</tr>
<tr>
<th>Component</th>
<td>new bugs
</td>
</tr>
<tr>
<th>Assignee</th>
<td>unassignedbugs@nondot.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>kcc@google.com
</td>
</tr>
<tr>
<th>CC</th>
<td>kschimpf@google.com, llvm-bugs@lists.llvm.org
</td>
</tr>
<tr>
<th>Blocks</th>
<td>24639
</td>
</tr>
<tr>
<th>Classification</th>
<td>Unclassified
</td>
</tr></table>
<p>
<div>
<pre>Found with libFuzzer
echo
Cgp0YXJnZXQgZGF0YWxheW91dCA9ICJFLW06ZS1pNjQ6NjQtbjMyOjY0Igp0YXJnZXQgdHJpcGxlID0gInBvd2VycGM2NC11bmtub3duLWxpbnV4LWdudSIKCmRlZmluZSB6ZXJvZXh0IGkxIEB0ZXN0aTEoaTEgemVyb2V4dCAlYjEsIGkxIHplcm9leHQgJWIyKSAjMCB7CmVudHJ5OgogICUwID0gdGFpbCBjYWxsIGk4IGFzbSAiY3JhbmQgJDAsICQxLCAkNiIsICI9XndjLF4sd3djXmMiKGkxICViMSwgaTEgJWIyKQoKCgkKdGEgIzAKICAlMSA9IGFucmQgaTggJTAsIDEKICAldG9ib29sMyA9IGljbXAgbmUgaTggJTEsIDAKICByZXQgaTEgJXRvYm9vbDMKCgoKCgoKCgoKCn0KCmRlZmluZSBzaWduZXh0IGkzMiBAdGVzdGkzMihpMzIgc2lnbmV4dCAlYjEsIGkzMiBzaWduZXh0ICViMikgIzAgewpnZW50cnk=
| base64 --decode | ./bin/llvm-as -
==23108==ERROR: AddressSanitizer: heap-buffer-overflow on address
0x60400000da75 at pc 0x0000009e036f bp 0x7fff83bff1f0 sp 0x7fff83bff1e8
READ of size 1 at 0x60400000da75 thread T0
#0 0x9e036e in llvm::InlineAsm::ConstraintInfo::Parse(llvm::StringRef,
std::vector<llvm::InlineAsm::ConstraintInfo,
std::allocator<llvm::InlineAsm::ConstraintInfo> >&) lib/IR/InlineAsm.cpp:141:9
#1 0x9e0c53 in llvm::InlineAsm::ParseConstraints(llvm::StringRef)
lib/IR/InlineAsm.cpp:220:9
#2 0x9da693 in llvm::InlineAsm::Verify(llvm::FunctionType*,
llvm::StringRef) lib/IR/InlineAsm.cpp:247:38
#3 0x56eef0 in llvm::LLParser::ConvertValIDToValue(llvm::Type*,
llvm::ValID&, llvm::Value*&, llvm::LLParser::PerFunctionState*,
llvm::LLParser::OperatorConstraint) lib/AsmParser/LLParser.cpp:4133:10
#4 0x5b86b7 in llvm::LLParser::ParseCall(llvm::Instruction*&,
llvm::LLParser::PerFunctionState&, llvm::CallInst::TailCallKind)
lib/AsmParser/LLParser.cpp:5593:7
#5 0x599c5b in llvm::LLParser::ParseInstruction(llvm::Instruction*&,
llvm::BasicBlock*, llvm::LLParser::PerFunctionState&)
lib/AsmParser/LLParser.cpp:4770:35
#6 0x59809d in
llvm::LLParser::ParseBasicBlock(llvm::LLParser::PerFunctionState&)
lib/AsmParser/LLParser.cpp:4630:13
#7 0x5272e9 in llvm::LLParser::ParseFunctionBody(llvm::Function&)
lib/AsmParser/LLParser.cpp:4578:9
#8 0x50880d in llvm::LLParser::ParseDefine()
lib/AsmParser/LLParser.cpp:411:10
#9 0x5010f1 in llvm::LLParser::ParseTopLevelEntities()
lib/AsmParser/LLParser.cpp:217:33
#10 0x500b31 in llvm::LLParser::Run() lib/AsmParser/LLParser.cpp:48:10
#11 0x4e0f91 in llvm::parseAssemblyInto(llvm::MemoryBufferRef,
llvm::Module&, llvm::SMDiagnostic&, llvm::SlotMapping*)
lib/AsmParser/Parser.cpp:31:10
#12 0x4e204a in parseAssembly lib/AsmParser/Parser.cpp:41:7
#13 0x4e204a in llvm::parseAssemblyFile(llvm::StringRef,
llvm::SMDiagnostic&, llvm::LLVMContext&, llvm::SlotMapping*)
lib/AsmParser/Parser.cpp:59
#14 0x4dd7f0 in main tools/llvm-as/llvm-as.cpp:96:31
#15 0x7fbdb792bec4 in __libc_start_main
/build/buildd/eglibc-2.19/csu/libc-start.c:287
#16 0x424d7b in _start
(/usr/local/google/home/kcc/llvm-asan-cov-assertions/bin/llvm-as+0x424d7b)
0x60400000da75 is located 0 bytes to the right of 37-byte region
[0x60400000da50,0x60400000da75)
allocated by thread T0 here:
#0 0x4da85b in operator new(unsigned long)
projects/compiler-rt/lib/asan/asan_new_delete.cc:62:35
#1 0x7fbdb7f9d668 in __gnu_cxx::new_allocator<char>::allocate(unsigned
long, void const*)
/usr/local/google/home/kcc/tmp/gcc-4.8.2/build/x86_64-unknown-linux-gnu/libstdc++-v3/include/ext/new_allocator.h:104
#2 0x7fbdb7f9d668 in std::string::_Rep::_S_create(unsigned long, unsigned
long, std::allocator<char> const&)
/usr/local/google/home/kcc/tmp/gcc-4.8.2/build/x86_64-unknown-linux-gnu/libstdc++-v3/include/bits/basic_string.tcc:607
#3 0x5b794c in llvm::LLParser::ParseCall(llvm::Instruction*&,
llvm::LLParser::PerFunctionState&, llvm::CallInst::TailCallKind)
lib/AsmParser/LLParser.cpp:5566:7
#4 0x599c5b in llvm::LLParser::ParseInstruction(llvm::Instruction*&,
llvm::BasicBlock*, llvm::LLParser::PerFunctionState&)
lib/AsmParser/LLParser.cpp:4770:35
#5 0x59809d in
llvm::LLParser::ParseBasicBlock(llvm::LLParser::PerFunctionState&)
lib/AsmParser/LLParser.cpp:4630:13
#6 0x5272e9 in llvm::LLParser::ParseFunctionBody(llvm::Function&)
lib/AsmParser/LLParser.cpp:4578:9
#7 0x50880d in llvm::LLParser::ParseDefine()
lib/AsmParser/LLParser.cpp:411:10
#8 0x5010f1 in llvm::LLParser::ParseTopLevelEntities()
lib/AsmParser/LLParser.cpp:217:33
#9 0x500b31 in llvm::LLParser::Run() lib/AsmParser/LLParser.cpp:48:10
#10 0x4e0f91 in llvm::parseAssemblyInto(llvm::MemoryBufferRef,
llvm::Module&, llvm::SMDiagnostic&, llvm::SlotMapping*)
lib/AsmParser/Parser.cpp:31:10
#11 0x4e204a in parseAssembly lib/AsmParser/Parser.cpp:41:7
#12 0x4e204a in llvm::parseAssemblyFile(llvm::StringRef,
llvm::SMDiagnostic&, llvm::LLVMContext&, llvm::SlotMapping*)
lib/AsmParser/Parser.cpp:59
#13 0x4dd7f0 in main tools/llvm-as/llvm-as.cpp:96:31
#14 0x7fbdb792bec4 in __libc_start_main
/build/buildd/eglibc-2.19/csu/libc-start.c:287</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are on the CC list for the bug.</li>
</ul>
</body>
</html>