[llvm-bugs] [Bug 24661] New: heap-buffer-overflow in llvm::InlineAsm::ConstraintInfo::Parse

[via llvm-bugs]

https://llvm.org/bugs/show_bug.cgi?id=24661

            Bug ID: 24661
           Summary: heap-buffer-overflow in
                    llvm::InlineAsm::ConstraintInfo::Parse
           Product: new-bugs
           Version: unspecified
          Hardware: PC
                OS: Linux
            Status: NEW
          Severity: normal
          Priority: P
         Component: new bugs
          Assignee: unassignedbugs at nondot.org
          Reporter: kcc at google.com
                CC: kschimpf at google.com, llvm-bugs at lists.llvm.org
            Blocks: 24639
    Classification: Unclassified

Found with libFuzzer

echo
Cgp0YXJnZXQgZGF0YWxheW91dCA9ICJFLW06ZS1pNjQ6NjQtbjMyOjY0Igp0YXJnZXQgdHJpcGxlID0gInBvd2VycGM2NC11bmtub3duLWxpbnV4LWdudSIKCmRlZmluZSB6ZXJvZXh0IGkxIEB0ZXN0aTEoaTEgemVyb2V4dCAlYjEsIGkxIHplcm9leHQgJWIyKSAjMCB7CmVudHJ5OgogICUwID0gdGFpbCBjYWxsIGk4IGFzbSAiY3JhbmQgJDAsICQxLCAkNiIsICI9XndjLF4sd3djXmMiKGkxICViMSwgaTEgJWIyKQoKCgkKdGEgIzAKICAlMSA9IGFucmQgaTggJTAsIDEKICAldG9ib29sMyA9IGljbXAgbmUgaTggJTEsIDAKICByZXQgaTEgJXRvYm9vbDMKCgoKCgoKCgoKCn0KCmRlZmluZSBzaWduZXh0IGkzMiBAdGVzdGkzMihpMzIgc2lnbmV4dCAlYjEsIGkzMiBzaWduZXh0ICViMikgIzAgewpnZW50cnk=
| base64 --decode  | ./bin/llvm-as -

==23108==ERROR: AddressSanitizer: heap-buffer-overflow on address
0x60400000da75 at pc 0x0000009e036f bp 0x7fff83bff1f0 sp 0x7fff83bff1e8
READ of size 1 at 0x60400000da75 thread T0
    #0 0x9e036e in llvm::InlineAsm::ConstraintInfo::Parse(llvm::StringRef,
std::vector<llvm::InlineAsm::ConstraintInfo,
std::allocator<llvm::InlineAsm::ConstraintInfo> >&) lib/IR/InlineAsm.cpp:141:9
    #1 0x9e0c53 in llvm::InlineAsm::ParseConstraints(llvm::StringRef)
lib/IR/InlineAsm.cpp:220:9
    #2 0x9da693 in llvm::InlineAsm::Verify(llvm::FunctionType*,
llvm::StringRef) lib/IR/InlineAsm.cpp:247:38
    #3 0x56eef0 in llvm::LLParser::ConvertValIDToValue(llvm::Type*,
llvm::ValID&, llvm::Value*&, llvm::LLParser::PerFunctionState*,
llvm::LLParser::OperatorConstraint) lib/AsmParser/LLParser.cpp:4133:10
    #4 0x5b86b7 in llvm::LLParser::ParseCall(llvm::Instruction*&,
llvm::LLParser::PerFunctionState&, llvm::CallInst::TailCallKind)
lib/AsmParser/LLParser.cpp:5593:7
    #5 0x599c5b in llvm::LLParser::ParseInstruction(llvm::Instruction*&,
llvm::BasicBlock*, llvm::LLParser::PerFunctionState&)
lib/AsmParser/LLParser.cpp:4770:35
    #6 0x59809d in
llvm::LLParser::ParseBasicBlock(llvm::LLParser::PerFunctionState&)
lib/AsmParser/LLParser.cpp:4630:13
    #7 0x5272e9 in llvm::LLParser::ParseFunctionBody(llvm::Function&)
lib/AsmParser/LLParser.cpp:4578:9
    #8 0x50880d in llvm::LLParser::ParseDefine()
lib/AsmParser/LLParser.cpp:411:10
    #9 0x5010f1 in llvm::LLParser::ParseTopLevelEntities()
lib/AsmParser/LLParser.cpp:217:33
    #10 0x500b31 in llvm::LLParser::Run() lib/AsmParser/LLParser.cpp:48:10
    #11 0x4e0f91 in llvm::parseAssemblyInto(llvm::MemoryBufferRef,
llvm::Module&, llvm::SMDiagnostic&, llvm::SlotMapping*)
lib/AsmParser/Parser.cpp:31:10
    #12 0x4e204a in parseAssembly lib/AsmParser/Parser.cpp:41:7
    #13 0x4e204a in llvm::parseAssemblyFile(llvm::StringRef,
llvm::SMDiagnostic&, llvm::LLVMContext&, llvm::SlotMapping*)
lib/AsmParser/Parser.cpp:59
    #14 0x4dd7f0 in main tools/llvm-as/llvm-as.cpp:96:31
    #15 0x7fbdb792bec4 in __libc_start_main
/build/buildd/eglibc-2.19/csu/libc-start.c:287
    #16 0x424d7b in _start
(/usr/local/google/home/kcc/llvm-asan-cov-assertions/bin/llvm-as+0x424d7b)

0x60400000da75 is located 0 bytes to the right of 37-byte region
[0x60400000da50,0x60400000da75)
allocated by thread T0 here:
    #0 0x4da85b in operator new(unsigned long)
projects/compiler-rt/lib/asan/asan_new_delete.cc:62:35
    #1 0x7fbdb7f9d668 in __gnu_cxx::new_allocator<char>::allocate(unsigned
long, void const*)
/usr/local/google/home/kcc/tmp/gcc-4.8.2/build/x86_64-unknown-linux-gnu/libstdc++-v3/include/ext/new_allocator.h:104
    #2 0x7fbdb7f9d668 in std::string::_Rep::_S_create(unsigned long, unsigned
long, std::allocator<char> const&)
/usr/local/google/home/kcc/tmp/gcc-4.8.2/build/x86_64-unknown-linux-gnu/libstdc++-v3/include/bits/basic_string.tcc:607
    #3 0x5b794c in llvm::LLParser::ParseCall(llvm::Instruction*&,
llvm::LLParser::PerFunctionState&, llvm::CallInst::TailCallKind)
lib/AsmParser/LLParser.cpp:5566:7
    #4 0x599c5b in llvm::LLParser::ParseInstruction(llvm::Instruction*&,
llvm::BasicBlock*, llvm::LLParser::PerFunctionState&)
lib/AsmParser/LLParser.cpp:4770:35
    #5 0x59809d in
llvm::LLParser::ParseBasicBlock(llvm::LLParser::PerFunctionState&)
lib/AsmParser/LLParser.cpp:4630:13
    #6 0x5272e9 in llvm::LLParser::ParseFunctionBody(llvm::Function&)
lib/AsmParser/LLParser.cpp:4578:9
    #7 0x50880d in llvm::LLParser::ParseDefine()
lib/AsmParser/LLParser.cpp:411:10
    #8 0x5010f1 in llvm::LLParser::ParseTopLevelEntities()
lib/AsmParser/LLParser.cpp:217:33
    #9 0x500b31 in llvm::LLParser::Run() lib/AsmParser/LLParser.cpp:48:10
    #10 0x4e0f91 in llvm::parseAssemblyInto(llvm::MemoryBufferRef,
llvm::Module&, llvm::SMDiagnostic&, llvm::SlotMapping*)
lib/AsmParser/Parser.cpp:31:10
    #11 0x4e204a in parseAssembly lib/AsmParser/Parser.cpp:41:7
    #12 0x4e204a in llvm::parseAssemblyFile(llvm::StringRef,
llvm::SMDiagnostic&, llvm::LLVMContext&, llvm::SlotMapping*)
lib/AsmParser/Parser.cpp:59
    #13 0x4dd7f0 in main tools/llvm-as/llvm-as.cpp:96:31
    #14 0x7fbdb792bec4 in __libc_start_main
/build/buildd/eglibc-2.19/csu/libc-start.c:287

-- 
You are receiving this mail because:
You are on the CC list for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/llvm-bugs/attachments/20150901/bc263c83/attachment.html>