[llvm] r229345 - [Bitcode reader] Fix a few assertions when reading invalid files

[Filipe Cabecinhas]

Author: filcab
Date: Sun Feb 15 18:03:11 2015
New Revision: 229345

URL: http://llvm.org/viewvc/llvm-project?rev=229345&view=rev
Log:
[Bitcode reader] Fix a few assertions when reading invalid files

Summary:
When creating {insert,extract}value instructions from a BitcodeReader, we
weren't verifying the fields were valid.

Bugs found with afl-fuzz

Reviewers: rafael

Subscribers: llvm-commits

Differential Revision: http://reviews.llvm.org/D7325

Added:
    llvm/trunk/test/Bitcode/Inputs/invalid-extractval-array-idx.bc
    llvm/trunk/test/Bitcode/Inputs/invalid-extractval-struct-idx.bc
    llvm/trunk/test/Bitcode/Inputs/invalid-extractval-too-many-idxs.bc
    llvm/trunk/test/Bitcode/Inputs/invalid-insertval-array-idx.bc
    llvm/trunk/test/Bitcode/Inputs/invalid-insertval-struct-idx.bc
    llvm/trunk/test/Bitcode/Inputs/invalid-insertval-too-many-idxs.bc
Modified:
    llvm/trunk/lib/Bitcode/Reader/BitcodeReader.cpp
    llvm/trunk/test/Bitcode/invalid.test

Modified: llvm/trunk/lib/Bitcode/Reader/BitcodeReader.cpp
URL: http://llvm.org/viewvc/llvm-project/llvm/trunk/lib/Bitcode/Reader/BitcodeReader.cpp?rev=229345&r1=229344&r2=229345&view=diff
==============================================================================
--- llvm/trunk/lib/Bitcode/Reader/BitcodeReader.cpp (original)
+++ llvm/trunk/lib/Bitcode/Reader/BitcodeReader.cpp Sun Feb 15 18:03:11 2015
@@ -3065,12 +3065,27 @@ std::error_code BitcodeReader::ParseFunc
         return Error("Invalid record");
 
       SmallVector<unsigned, 4> EXTRACTVALIdx;
+      Type *CurTy = Agg->getType();
       for (unsigned RecSize = Record.size();
            OpNum != RecSize; ++OpNum) {
+        bool IsArray = CurTy->isArrayTy();
+        bool IsStruct = CurTy->isStructTy();
         uint64_t Index = Record[OpNum];
+
+        if (!IsStruct && !IsArray)
+          return Error("EXTRACTVAL: Invalid type");
         if ((unsigned)Index != Index)
           return Error("Invalid value");
+        if (IsStruct && Index >= CurTy->subtypes().size())
+          return Error("EXTRACTVAL: Invalid struct index");
+        if (IsArray && Index >= CurTy->getArrayNumElements())
+          return Error("EXTRACTVAL: Invalid array index");
         EXTRACTVALIdx.push_back((unsigned)Index);
+
+        if (IsStruct)
+          CurTy = CurTy->subtypes()[Index];
+        else
+          CurTy = CurTy->subtypes()[0];
       }
 
       I = ExtractValueInst::Create(Agg, EXTRACTVALIdx);
@@ -3089,12 +3104,29 @@ std::error_code BitcodeReader::ParseFunc
         return Error("Invalid record");
 
       SmallVector<unsigned, 4> INSERTVALIdx;
+      Type *CurTy = Agg->getType();
       for (unsigned RecSize = Record.size();
            OpNum != RecSize; ++OpNum) {
+        bool IsArray = CurTy->isArrayTy();
+        bool IsStruct = CurTy->isStructTy();
         uint64_t Index = Record[OpNum];
+
+        if (!IsStruct && !IsArray)
+          return Error("INSERTVAL: Invalid type");
+        if (!CurTy->isStructTy() && !CurTy->isArrayTy())
+          return Error("Invalid type");
         if ((unsigned)Index != Index)
           return Error("Invalid value");
+        if (IsStruct && Index >= CurTy->subtypes().size())
+          return Error("INSERTVAL: Invalid struct index");
+        if (IsArray && Index >= CurTy->getArrayNumElements())
+          return Error("INSERTVAL: Invalid array index");
+
         INSERTVALIdx.push_back((unsigned)Index);
+        if (IsStruct)
+          CurTy = CurTy->subtypes()[Index];
+        else
+          CurTy = CurTy->subtypes()[0];
       }
 
       I = InsertValueInst::Create(Agg, Val, INSERTVALIdx);

Added: llvm/trunk/test/Bitcode/Inputs/invalid-extractval-array-idx.bc
URL: http://llvm.org/viewvc/llvm-project/llvm/trunk/test/Bitcode/Inputs/invalid-extractval-array-idx.bc?rev=229345&view=auto
==============================================================================
Binary files llvm/trunk/test/Bitcode/Inputs/invalid-extractval-array-idx.bc (added) and llvm/trunk/test/Bitcode/Inputs/invalid-extractval-array-idx.bc Sun Feb 15 18:03:11 2015 differ

Added: llvm/trunk/test/Bitcode/Inputs/invalid-extractval-struct-idx.bc
URL: http://llvm.org/viewvc/llvm-project/llvm/trunk/test/Bitcode/Inputs/invalid-extractval-struct-idx.bc?rev=229345&view=auto
==============================================================================
Binary files llvm/trunk/test/Bitcode/Inputs/invalid-extractval-struct-idx.bc (added) and llvm/trunk/test/Bitcode/Inputs/invalid-extractval-struct-idx.bc Sun Feb 15 18:03:11 2015 differ

Added: llvm/trunk/test/Bitcode/Inputs/invalid-extractval-too-many-idxs.bc
URL: http://llvm.org/viewvc/llvm-project/llvm/trunk/test/Bitcode/Inputs/invalid-extractval-too-many-idxs.bc?rev=229345&view=auto
==============================================================================
Binary files llvm/trunk/test/Bitcode/Inputs/invalid-extractval-too-many-idxs.bc (added) and llvm/trunk/test/Bitcode/Inputs/invalid-extractval-too-many-idxs.bc Sun Feb 15 18:03:11 2015 differ

Added: llvm/trunk/test/Bitcode/Inputs/invalid-insertval-array-idx.bc
URL: http://llvm.org/viewvc/llvm-project/llvm/trunk/test/Bitcode/Inputs/invalid-insertval-array-idx.bc?rev=229345&view=auto
==============================================================================
Binary files llvm/trunk/test/Bitcode/Inputs/invalid-insertval-array-idx.bc (added) and llvm/trunk/test/Bitcode/Inputs/invalid-insertval-array-idx.bc Sun Feb 15 18:03:11 2015 differ

Added: llvm/trunk/test/Bitcode/Inputs/invalid-insertval-struct-idx.bc
URL: http://llvm.org/viewvc/llvm-project/llvm/trunk/test/Bitcode/Inputs/invalid-insertval-struct-idx.bc?rev=229345&view=auto
==============================================================================
Binary files llvm/trunk/test/Bitcode/Inputs/invalid-insertval-struct-idx.bc (added) and llvm/trunk/test/Bitcode/Inputs/invalid-insertval-struct-idx.bc Sun Feb 15 18:03:11 2015 differ

Added: llvm/trunk/test/Bitcode/Inputs/invalid-insertval-too-many-idxs.bc
URL: http://llvm.org/viewvc/llvm-project/llvm/trunk/test/Bitcode/Inputs/invalid-insertval-too-many-idxs.bc?rev=229345&view=auto
==============================================================================
Binary files llvm/trunk/test/Bitcode/Inputs/invalid-insertval-too-many-idxs.bc (added) and llvm/trunk/test/Bitcode/Inputs/invalid-insertval-too-many-idxs.bc Sun Feb 15 18:03:11 2015 differ

Modified: llvm/trunk/test/Bitcode/invalid.test
URL: http://llvm.org/viewvc/llvm-project/llvm/trunk/test/Bitcode/invalid.test?rev=229345&r1=229344&r2=229345&view=diff
==============================================================================
--- llvm/trunk/test/Bitcode/invalid.test (original)
+++ llvm/trunk/test/Bitcode/invalid.test Sun Feb 15 18:03:11 2015
@@ -17,3 +17,24 @@ UNEXPECTED-EOF: Unexpected end of file
 BAD-ABBREV-NUMBER: Invalid abbrev number
 BAD-TYPE-TABLE-FORWARD-REF: Invalid TYPE table: Only named structs can be forward referenced
 BAD-BITWIDTH: Bitwidth for integer type out of range
+
+RUN: not llvm-dis -disable-output %p/Inputs/invalid-extractval-array-idx.bc 2>&1 | \
+RUN:   FileCheck --check-prefix=EXTRACT-ARRAY %s
+RUN: not llvm-dis -disable-output %p/Inputs/invalid-extractval-struct-idx.bc 2>&1 | \
+RUN:   FileCheck --check-prefix=EXTRACT-STRUCT %s
+RUN: not llvm-dis -disable-output %p/Inputs/invalid-extractval-too-many-idxs.bc 2>&1 | \
+RUN:   FileCheck --check-prefix=EXTRACT-IDXS %s
+RUN: not llvm-dis -disable-output %p/Inputs/invalid-insertval-array-idx.bc 2>&1 | \
+RUN:   FileCheck --check-prefix=INSERT-ARRAY %s
+RUN: not llvm-dis -disable-output %p/Inputs/invalid-insertval-struct-idx.bc 2>&1 | \
+RUN:   FileCheck --check-prefix=INSERT-STRUCT %s
+RUN: not llvm-dis -disable-output %p/Inputs/invalid-insertval-too-many-idxs.bc 2>&1 | \
+RUN:   FileCheck --check-prefix=INSERT-IDXS %s
+
+
+EXTRACT-ARRAY: EXTRACTVAL: Invalid array index
+EXTRACT-STRUCT: EXTRACTVAL: Invalid struct index
+EXTRACT-IDXS: EXTRACTVAL: Invalid type
+INSERT-ARRAY: INSERTVAL: Invalid array index
+INSERT-STRUCT: INSERTVAL: Invalid struct index
+INSERT-IDXS: INSERTVAL: Invalid type