[llvm] r365750 - [BitcodeReader] Validate OpNum, before accessing Record array.

[Florian Hahn via llvm-commits]

Author: fhahn
Date: Thu Jul 11 02:57:00 2019
New Revision: 365750

URL: http://llvm.org/viewvc/llvm-project?rev=365750&view=rev
Log:
[BitcodeReader] Validate OpNum, before accessing Record array.

Currently invalid bitcode files can cause a crash, when OpNum exceeds
the number of elements in Record, like in the attached bitcode file.

The test case was generated by clusterfuzz: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15698

Reviewers: t.p.northover, thegameg, jfb

Reviewed By: jfb

Differential Revision: https://reviews.llvm.org/D64507

Added:
    llvm/trunk/test/Bitcode/Inputs/invalid-fcmp-opnum.bc   (with props)
Modified:
    llvm/trunk/lib/Bitcode/Reader/BitcodeReader.cpp
    llvm/trunk/test/Bitcode/invalid.test

Modified: llvm/trunk/lib/Bitcode/Reader/BitcodeReader.cpp
URL: http://llvm.org/viewvc/llvm-project/llvm/trunk/lib/Bitcode/Reader/BitcodeReader.cpp?rev=365750&r1=365749&r2=365750&view=diff
==============================================================================
--- llvm/trunk/lib/Bitcode/Reader/BitcodeReader.cpp (original)
+++ llvm/trunk/lib/Bitcode/Reader/BitcodeReader.cpp Thu Jul 11 02:57:00 2019
@@ -4165,6 +4165,10 @@ Error BitcodeReader::parseFunctionBody(F
           popValue(Record, OpNum, NextValueNo, LHS->getType(), RHS))
         return error("Invalid record");
 
+      if (OpNum >= Record.size())
+        return error(
+            "Invalid record: operand number exceeded available operands");
+
       unsigned PredVal = Record[OpNum];
       bool IsFP = LHS->getType()->isFPOrFPVectorTy();
       FastMathFlags FMF;

Added: llvm/trunk/test/Bitcode/Inputs/invalid-fcmp-opnum.bc
URL: http://llvm.org/viewvc/llvm-project/llvm/trunk/test/Bitcode/Inputs/invalid-fcmp-opnum.bc?rev=365750&view=auto
==============================================================================
Binary file - no diff available.

Propchange: llvm/trunk/test/Bitcode/Inputs/invalid-fcmp-opnum.bc
------------------------------------------------------------------------------
    svn:mime-type = application/octet-stream

Modified: llvm/trunk/test/Bitcode/invalid.test
URL: http://llvm.org/viewvc/llvm-project/llvm/trunk/test/Bitcode/invalid.test?rev=365750&r1=365749&r2=365750&view=diff
==============================================================================
--- llvm/trunk/test/Bitcode/invalid.test (original)
+++ llvm/trunk/test/Bitcode/invalid.test Thu Jul 11 02:57:00 2019
@@ -235,3 +235,8 @@ RUN: not llvm-dis -disable-output %p/Inp
 RUN:   FileCheck --check-prefix=NONPOINTER-ATOMICRMW %s
 
 NONPOINTER-ATOMICRMW: Invalid record
+
+RUN: not llvm-dis -disable-output %p/Inputs/invalid-fcmp-opnum.bc 2>&1 | \
+RUN:   FileCheck --check-prefix=INVALID-FCMP-OPNUM %s
+
+INVALID-FCMP-OPNUM: Invalid record: operand number exceeded available operands