[llvm] r316786 - Fix llvm-special-case-list-fuzzer regexp exception

[Vlad Tsyrklevich via llvm-commits]

Author: vlad.tsyrklevich
Date: Fri Oct 27 12:15:13 2017
New Revision: 316786

URL: http://llvm.org/viewvc/llvm-project?rev=316786&view=rev
Log:
Fix llvm-special-case-list-fuzzer regexp exception

Summary:
Original oss-fuzz report:
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3727#c2

The minimized test case that causes this failure:
5b 5b 5b 3d 47 53 00 5b  3d 5d 5b 5d 0a     [[[=GS.[=][].

Note the string "=GS\x00". The failure happens because the code is
searching the string against an array of known collated names. "GS\x00"
is a hit, but since len takes into account an extra NUL byte, indexing
into cp->name[len] goes one byte past it's allocated memory. Fix this to
use a strlen(cp->name) comparison to account for NUL bytes in the input.

Reviewers: pcc

Reviewed By: pcc

Subscribers: hctim, kcc

Differential Revision: https://reviews.llvm.org/D39380

Modified:
    llvm/trunk/lib/Support/regcomp.c
    llvm/trunk/unittests/Support/RegexTest.cpp

Modified: llvm/trunk/lib/Support/regcomp.c
URL: http://llvm.org/viewvc/llvm-project/llvm/trunk/lib/Support/regcomp.c?rev=316786&r1=316785&r2=316786&view=diff
==============================================================================
--- llvm/trunk/lib/Support/regcomp.c (original)
+++ llvm/trunk/lib/Support/regcomp.c Fri Oct 27 12:15:13 2017
@@ -1008,7 +1008,7 @@ p_b_coll_elem(struct parse *p,
 {
 	char *sp = p->next;
 	struct cname *cp;
-	int len;
+	size_t len;
 
 	while (MORE() && !SEETWO(endc, ']'))
 		NEXT();
@@ -1018,7 +1018,7 @@ p_b_coll_elem(struct parse *p,
 	}
 	len = p->next - sp;
 	for (cp = cnames; cp->name != NULL; cp++)
-		if (strncmp(cp->name, sp, len) == 0 && cp->name[len] == '\0')
+		if (strncmp(cp->name, sp, len) == 0 && strlen(cp->name) == len)
 			return(cp->code);	/* known name */
 	if (len == 1)
 		return(*sp);	/* single character */

Modified: llvm/trunk/unittests/Support/RegexTest.cpp
URL: http://llvm.org/viewvc/llvm-project/llvm/trunk/unittests/Support/RegexTest.cpp?rev=316786&r1=316785&r2=316786&view=diff
==============================================================================
--- llvm/trunk/unittests/Support/RegexTest.cpp (original)
+++ llvm/trunk/unittests/Support/RegexTest.cpp Fri Oct 27 12:15:13 2017
@@ -171,4 +171,12 @@ TEST_F(RegexTest, MatchInvalid) {
   EXPECT_FALSE(r1.match("X"));
 }
 
+// https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3727
+TEST_F(RegexTest, OssFuzz3727Regression) {
+  // Wrap in a StringRef so the NUL byte doesn't terminate the string
+  Regex r(StringRef("[[[=GS\x00[=][", 10));
+  std::string Error;
+  EXPECT_FALSE(r.isValid(Error));
+}
+
 }