[PATCH] D65897: [BitcodeReader] Check if we can create a null constant for type.

[Florian Hahn via Phabricator via llvm-commits]

fhahn created this revision.
fhahn added reviewers: t.p.northover, jfb.
Herald added subscribers: dexonsmith, hiraditya.
Herald added a project: LLVM.

We cannot create null constants for certain types, e.g. VoidTy,
FunctionTy or LabelTy. getNullValue asserts if we pass in an
unsupported type. We should also check for opaque types, but I'm not
sure how.

This fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14795.


Repository:
  rG LLVM Github Monorepo

https://reviews.llvm.org/D65897

Files:
  llvm/lib/Bitcode/Reader/BitcodeReader.cpp
  llvm/test/Bitcode/invalid-type-for-null-constant.ll
  llvm/test/Bitcode/invalid-type-for-null-constant.ll.bc


Index: llvm/test/Bitcode/invalid-type-for-null-constant.ll
===================================================================
--- /dev/null
+++ llvm/test/Bitcode/invalid-type-for-null-constant.ll
@@ -0,0 +1,6 @@
+; Bitcode with a CST_CODE_NULL with void type.
+
+; RUN: not llvm-dis %s.bc -o - 2>&1 | FileCheck %s
+
+; CHECK: error: Invalid type for a constant null value
+
Index: llvm/lib/Bitcode/Reader/BitcodeReader.cpp
===================================================================
--- llvm/lib/Bitcode/Reader/BitcodeReader.cpp
+++ llvm/lib/Bitcode/Reader/BitcodeReader.cpp
@@ -2377,6 +2377,8 @@
       CurTy = flattenPointerTypes(CurFullTy);
       continue;  // Skip the ValueList manipulation.
     case bitc::CST_CODE_NULL:      // NULL
+      if (CurTy->isVoidTy() || CurTy->isFunctionTy() || CurTy->isLabelTy())
+        return error("Invalid type for a constant null value");
       V = Constant::getNullValue(CurTy);
       break;
     case bitc::CST_CODE_INTEGER:   // INTEGER: [intval]


-------------- next part --------------
A non-text attachment was scrubbed...
Name: D65897.213970.patch
Type: text/x-patch
Size: 1006 bytes
Desc: not available
URL: <http://lists.llvm.org/pipermail/llvm-commits/attachments/20190807/da370278/attachment.bin>