[PATCH] D51708: [RISCV] Fix AddressSanitizer heap-buffer-overflow in disassembling
Ana Pazos via Phabricator via llvm-commits
llvm-commits at lists.llvm.org
Fri Sep 7 11:27:09 PDT 2018
This revision was automatically updated to reflect the committed changes.
Closed by commit rL341686: [RISCV] Fix AddressSanitizer heap-buffer-overflow in disassembling (authored by apazos, committed by ).
Herald added subscribers: llvm-commits, jrtc27.
Changed prior to commit:
https://reviews.llvm.org/D51708?vs=164471&id=164472#toc
Repository:
rL LLVM
https://reviews.llvm.org/D51708
Files:
llvm/trunk/lib/Target/RISCV/Disassembler/RISCVDisassembler.cpp
llvm/trunk/test/MC/Disassembler/RISCV/fuzzer-invalid.txt
llvm/trunk/test/MC/Disassembler/RISCV/lit.local.cfg
Index: llvm/trunk/test/MC/Disassembler/RISCV/lit.local.cfg
===================================================================
--- llvm/trunk/test/MC/Disassembler/RISCV/lit.local.cfg
+++ llvm/trunk/test/MC/Disassembler/RISCV/lit.local.cfg
@@ -0,0 +1,3 @@
+if not 'RISCV' in config.root.targets:
+ config.unsupported = True
+
Index: llvm/trunk/test/MC/Disassembler/RISCV/fuzzer-invalid.txt
===================================================================
--- llvm/trunk/test/MC/Disassembler/RISCV/fuzzer-invalid.txt
+++ llvm/trunk/test/MC/Disassembler/RISCV/fuzzer-invalid.txt
@@ -0,0 +1,8 @@
+# RUN: not llvm-mc -disassemble -triple=riscv32 < %s 2>&1 | FileCheck %s
+# RUN: not llvm-mc -disassemble -triple=riscv64 < %s 2>&1 | FileCheck %s
+#
+# Test generated by a LLVM MC Disassembler Protocol Buffer Fuzzer
+# for the RISC-V assembly language.
+
+[0xf9 0x95 0xab 0x99]
+# CHECK: warning: invalid instruction encoding
Index: llvm/trunk/lib/Target/RISCV/Disassembler/RISCVDisassembler.cpp
===================================================================
--- llvm/trunk/lib/Target/RISCV/Disassembler/RISCVDisassembler.cpp
+++ llvm/trunk/lib/Target/RISCV/Disassembler/RISCVDisassembler.cpp
@@ -257,11 +257,19 @@
// It's a 32 bit instruction if bit 0 and 1 are 1.
if ((Bytes[0] & 0x3) == 0x3) {
+ if (Bytes.size() < 4) {
+ Size = 0;
+ return MCDisassembler::Fail;
+ }
Insn = support::endian::read32le(Bytes.data());
LLVM_DEBUG(dbgs() << "Trying RISCV32 table :\n");
Result = decodeInstruction(DecoderTable32, MI, Insn, Address, this, STI);
Size = 4;
} else {
+ if (Bytes.size() < 2) {
+ Size = 0;
+ return MCDisassembler::Fail;
+ }
Insn = support::endian::read16le(Bytes.data());
if (!STI.getFeatureBits()[RISCV::Feature64Bit]) {
-------------- next part --------------
A non-text attachment was scrubbed...
Name: D51708.164472.patch
Type: text/x-patch
Size: 1812 bytes
Desc: not available
URL: <http://lists.llvm.org/pipermail/llvm-commits/attachments/20180907/1f8a2062/attachment-0001.bin>
More information about the llvm-commits
mailing list