[llvm] r226986 - [Bitcode] Diagnose errors instead of asserting from bad input

[Filipe Cabecinhas]

Author: filcab
Date: Fri Jan 23 22:15:05 2015
New Revision: 226986

URL: http://llvm.org/viewvc/llvm-project?rev=226986&view=rev
Log:
[Bitcode] Diagnose errors instead of asserting from bad input

Eventually we can make some of these pass the error along to the caller.

Reports a fatal error if:
We find an invalid abbrev record
We try to get an invalid abbrev number
We can't fill the current word due to an EOF

Fixed an invalid bitcode test to check for output with FileCheck

Bugs found with afl-fuzz

Added:
    llvm/trunk/test/Bitcode/Inputs/invalid-abbrev.bc
    llvm/trunk/test/Bitcode/Inputs/invalid-bad-abbrev-number.bc
    llvm/trunk/test/Bitcode/Inputs/invalid-unexpected-eof.bc
Modified:
    llvm/trunk/include/llvm/Bitcode/BitstreamReader.h
    llvm/trunk/lib/Bitcode/Reader/BitstreamReader.cpp
    llvm/trunk/test/Bitcode/invalid.test

Modified: llvm/trunk/include/llvm/Bitcode/BitstreamReader.h
URL: http://llvm.org/viewvc/llvm-project/llvm/trunk/include/llvm/Bitcode/BitstreamReader.h?rev=226986&r1=226985&r2=226986&view=diff
==============================================================================
--- llvm/trunk/include/llvm/Bitcode/BitstreamReader.h (original)
+++ llvm/trunk/include/llvm/Bitcode/BitstreamReader.h Fri Jan 23 22:15:05 2015
@@ -315,7 +315,8 @@ public:
   }
 
   void fillCurWord() {
-    assert(Size == 0 || NextChar < (unsigned)Size);
+    if (Size != 0 && NextChar >= (unsigned)Size)
+      report_fatal_error("Unexpected end of file");
 
     // Read the next word from the stream.
     uint8_t Array[sizeof(word_t)] = {0};
@@ -490,11 +491,11 @@ private:
   //===--------------------------------------------------------------------===//
 
 public:
-
   /// Return the abbreviation for the specified AbbrevId.
   const BitCodeAbbrev *getAbbrev(unsigned AbbrevID) {
-    unsigned AbbrevNo = AbbrevID-bitc::FIRST_APPLICATION_ABBREV;
-    assert(AbbrevNo < CurAbbrevs.size() && "Invalid abbrev #!");
+    unsigned AbbrevNo = AbbrevID - bitc::FIRST_APPLICATION_ABBREV;
+    if (AbbrevNo >= CurAbbrevs.size())
+      report_fatal_error("Invalid abbrev number");
     return CurAbbrevs[AbbrevNo].get();
   }
 

Modified: llvm/trunk/lib/Bitcode/Reader/BitstreamReader.cpp
URL: http://llvm.org/viewvc/llvm-project/llvm/trunk/lib/Bitcode/Reader/BitstreamReader.cpp?rev=226986&r1=226985&r2=226986&view=diff
==============================================================================
--- llvm/trunk/lib/Bitcode/Reader/BitstreamReader.cpp (original)
+++ llvm/trunk/lib/Bitcode/Reader/BitstreamReader.cpp Fri Jan 23 22:15:05 2015
@@ -170,8 +170,12 @@ unsigned BitstreamCursor::readRecord(uns
   unsigned Code;
   if (CodeOp.isLiteral())
     Code = CodeOp.getLiteralValue();
-  else
+  else {
+    if (CodeOp.getEncoding() == BitCodeAbbrevOp::Array ||
+        CodeOp.getEncoding() == BitCodeAbbrevOp::Blob)
+      report_fatal_error("Abbreviation starts with an Array or a Blob");
     Code = readAbbreviatedField(*this, CodeOp);
+  }
 
   for (unsigned i = 1, e = Abbv->getNumOperandInfos(); i != e; ++i) {
     const BitCodeAbbrevOp &Op = Abbv->getOperandInfo(i);

Added: llvm/trunk/test/Bitcode/Inputs/invalid-abbrev.bc
URL: http://llvm.org/viewvc/llvm-project/llvm/trunk/test/Bitcode/Inputs/invalid-abbrev.bc?rev=226986&view=auto
==============================================================================
Binary files llvm/trunk/test/Bitcode/Inputs/invalid-abbrev.bc (added) and llvm/trunk/test/Bitcode/Inputs/invalid-abbrev.bc Fri Jan 23 22:15:05 2015 differ

Added: llvm/trunk/test/Bitcode/Inputs/invalid-bad-abbrev-number.bc
URL: http://llvm.org/viewvc/llvm-project/llvm/trunk/test/Bitcode/Inputs/invalid-bad-abbrev-number.bc?rev=226986&view=auto
==============================================================================
--- llvm/trunk/test/Bitcode/Inputs/invalid-bad-abbrev-number.bc (added)
+++ llvm/trunk/test/Bitcode/Inputs/invalid-bad-abbrev-number.bc Fri Jan 23 22:15:05 2015
@@ -0,0 +1 @@
+BCÀÞ!0000000000
\ No newline at end of file

Added: llvm/trunk/test/Bitcode/Inputs/invalid-unexpected-eof.bc
URL: http://llvm.org/viewvc/llvm-project/llvm/trunk/test/Bitcode/Inputs/invalid-unexpected-eof.bc?rev=226986&view=auto
==============================================================================
--- llvm/trunk/test/Bitcode/Inputs/invalid-unexpected-eof.bc (added)
+++ llvm/trunk/test/Bitcode/Inputs/invalid-unexpected-eof.bc Fri Jan 23 22:15:05 2015
@@ -0,0 +1 @@
+BCÀÞ!00000000000000000000
\ No newline at end of file

Modified: llvm/trunk/test/Bitcode/invalid.test
URL: http://llvm.org/viewvc/llvm-project/llvm/trunk/test/Bitcode/invalid.test?rev=226986&r1=226985&r2=226986&view=diff
==============================================================================
--- llvm/trunk/test/Bitcode/invalid.test (original)
+++ llvm/trunk/test/Bitcode/invalid.test Fri Jan 23 22:15:05 2015
@@ -1 +1,13 @@
-RUN: not llvm-dis -disable-output %p/Inputs/invalid-pr20485.bc
+RUN: not llvm-dis -disable-output %p/Inputs/invalid-pr20485.bc 2>&1 | \
+RUN:   FileCheck --check-prefix=INVALID-ENCODING %s
+RUN: not llvm-dis -disable-output %p/Inputs/invalid-abbrev.bc 2>&1 | \
+RUN:   FileCheck --check-prefix=BAD-ABBREV %s
+RUN: not llvm-dis -disable-output %p/Inputs/invalid-unexpected-eof.bc 2>&1 | \
+RUN:   FileCheck --check-prefix=UNEXPECTED-EOF %s
+RUN: not llvm-dis -disable-output %p/Inputs/invalid-bad-abbrev-number.bc 2>&1 | \
+RUN:   FileCheck --check-prefix=BAD-ABBREV-NUMBER %s
+
+INVALID-ENCODING: Invalid encoding
+BAD-ABBREV: Abbreviation starts with an Array or a Blob
+UNEXPECTED-EOF: Unexpected end of file
+BAD-ABBREV-NUMBER: Invalid abbrev number