[llvm] [BitcodeReader] Add bounds checking on Strtab (PR #76403)

[via llvm-commits]

https://github.com/DavidKorczynski created https://github.com/llvm/llvm-project/pull/76403

This is needed to protect against global overflows, which was found by a fuzzer recently.

Fixes: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65283

>From 3215b01bea5722f9e5940d395a88d1e49107811a Mon Sep 17 00:00:00 2001
From: David Korczynski <david at adalogics.com>
Date: Tue, 26 Dec 2023 11:47:21 -0800
Subject: [PATCH] [BitcodeReader] Add bounds checking on Strtab

This is needed to protect against global overflows, which was found by a
fuzzer recently.

Fixes: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65283

Signed-off-by: David Korczynski <david at adalogics.com>
---
 llvm/lib/Bitcode/Reader/BitcodeReader.cpp | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/llvm/lib/Bitcode/Reader/BitcodeReader.cpp b/llvm/lib/Bitcode/Reader/BitcodeReader.cpp
index 8907f6fa4ff3fd..77896f6f99d338 100644
--- a/llvm/lib/Bitcode/Reader/BitcodeReader.cpp
+++ b/llvm/lib/Bitcode/Reader/BitcodeReader.cpp
@@ -4218,6 +4218,10 @@ Error BitcodeReader::parseGlobalIndirectSymbolRecord(
 
   // Check whether we have enough values to read a partition name.
   if (OpNum + 1 < Record.size()) {
+    // Check Strtab has enough values for the partition.
+    if (Record[OpNum] + Record[OpNum + 1] > Strtab.size()) {
+      return error("Malformed partition, too large.");
+    }
     NewGA->setPartition(
         StringRef(Strtab.data() + Record[OpNum], Record[OpNum + 1]));
     OpNum += 2;