[PATCH] D46214: Avoid reading past end of archive looking for long file name

[Bob Haarman via Phabricator via llvm-commits]

inglorion created this revision.
inglorion added reviewers: enderby, rnk, ruiu.
Herald added a subscriber: hiraditya.

GNU-style archives store long file names separated by newlines. The
last file name is not followed by a newline. This change stops the
search for the newline at the end of the string table, which avoids
a crash.

Fixes PR37244.


https://reviews.llvm.org/D46214

Files:
  llvm/lib/Object/Archive.cpp


Index: llvm/lib/Object/Archive.cpp
===================================================================
--- llvm/lib/Object/Archive.cpp
+++ llvm/lib/Object/Archive.cpp
@@ -168,22 +168,25 @@
     }
 
     // Verify it.
-    if (StringOffset >= Parent->getStringTable().size()) {
+    StringRef ST = Parent->getStringTable();
+    if (StringOffset >= ST.size()) {
       uint64_t ArchiveOffset = reinterpret_cast<const char *>(ArMemHdr) -
                                Parent->getData().data();
       return malformedError("long name offset " + Twine(StringOffset) + " past "
                             "the end of the string table for archive member "
                             "header at offset " + Twine(ArchiveOffset));
     }
-    const char *addr = Parent->getStringTable().begin() + StringOffset;
 
+    const char *Start = ST.begin() + StringOffset;
     // GNU long file names end with a "/\n".
     if (Parent->kind() == Archive::K_GNU ||
         Parent->kind() == Archive::K_GNU64) {
-      StringRef::size_type End = StringRef(addr).find('\n');
-      return StringRef(addr, End - 1);
+      StringRef::size_type End = ST.find('\n', StringOffset);
+      if (End == StringRef::npos)
+        End = ST.size();
+      return StringRef(Start, End - StringOffset - 1);
     }
-    return addr;
+    return Start;
   }
 
   if (Name.startswith("#1/")) {


-------------- next part --------------
A non-text attachment was scrubbed...
Name: D46214.144405.patch
Type: text/x-patch
Size: 1367 bytes
Desc: not available
URL: <http://lists.llvm.org/pipermail/llvm-commits/attachments/20180427/2268b558/attachment.bin>