[PATCH] D66979: [InstrProf] Tighten a check for malformed data records in raw profiles
Phabricator via Phabricator via llvm-commits
llvm-commits at lists.llvm.org
Tue Sep 3 15:22:57 PDT 2019
This revision was not accepted when it landed; it landed in state "Changes Planned".
This revision was automatically updated to reflect the committed changes.
Closed by commit rL370826: [InstrProf] Tighten a check for malformed data records in raw profiles (authored by vedantk, committed by ).
Changed prior to commit:
https://reviews.llvm.org/D66979?vs=217997&id=218545#toc
Repository:
rL LLVM
CHANGES SINCE LAST ACTION
https://reviews.llvm.org/D66979/new/
https://reviews.llvm.org/D66979
Files:
llvm/trunk/include/llvm/ProfileData/InstrProfReader.h
llvm/trunk/lib/ProfileData/InstrProfReader.cpp
llvm/trunk/test/tools/llvm-profdata/Inputs/malformed-ptr-to-counter-array.profraw
llvm/trunk/test/tools/llvm-profdata/malformed-ptr-to-counter-array.test
Index: llvm/trunk/lib/ProfileData/InstrProfReader.cpp
===================================================================
--- llvm/trunk/lib/ProfileData/InstrProfReader.cpp
+++ llvm/trunk/lib/ProfileData/InstrProfReader.cpp
@@ -413,13 +413,19 @@
if (NumCounters == 0)
return error(instrprof_error::malformed);
- auto RawCounts = makeArrayRef(getCounter(CounterPtr), NumCounters);
auto *NamesStartAsCounter = reinterpret_cast<const uint64_t *>(NamesStart);
+ ptrdiff_t MaxNumCounters = NamesStartAsCounter - CountersStart;
- // Check bounds.
- if (RawCounts.data() < CountersStart ||
- RawCounts.data() + RawCounts.size() > NamesStartAsCounter)
+ // Check bounds. Note that the counter pointer embedded in the data record
+ // may itself be corrupt.
+ if (NumCounters > MaxNumCounters)
return error(instrprof_error::malformed);
+ ptrdiff_t CounterOffset = getCounterOffset(CounterPtr);
+ if (CounterOffset < 0 || CounterOffset > MaxNumCounters ||
+ (CounterOffset + NumCounters) > MaxNumCounters)
+ return error(instrprof_error::malformed);
+
+ auto RawCounts = makeArrayRef(getCounter(CounterOffset), NumCounters);
if (ShouldSwapBytes) {
Record.Counts.clear();
Index: llvm/trunk/include/llvm/ProfileData/InstrProfReader.h
===================================================================
--- llvm/trunk/include/llvm/ProfileData/InstrProfReader.h
+++ llvm/trunk/include/llvm/ProfileData/InstrProfReader.h
@@ -268,8 +268,14 @@
return (const char *)ValueDataStart;
}
- const uint64_t *getCounter(IntPtrT CounterPtr) const {
- ptrdiff_t Offset = (swap(CounterPtr) - CountersDelta) / sizeof(uint64_t);
+ /// Get the offset of \p CounterPtr from the start of the counters section of
+ /// the profile. The offset has units of "number of counters", i.e. increasing
+ /// the offset by 1 corresponds to an increase in the *byte offset* by 8.
+ ptrdiff_t getCounterOffset(IntPtrT CounterPtr) const {
+ return (swap(CounterPtr) - CountersDelta) / sizeof(uint64_t);
+ }
+
+ const uint64_t *getCounter(ptrdiff_t Offset) const {
return CountersStart + Offset;
}
Index: llvm/trunk/test/tools/llvm-profdata/malformed-ptr-to-counter-array.test
===================================================================
--- llvm/trunk/test/tools/llvm-profdata/malformed-ptr-to-counter-array.test
+++ llvm/trunk/test/tools/llvm-profdata/malformed-ptr-to-counter-array.test
@@ -0,0 +1,5 @@
+REQUIRES: zlib
+
+RUN: not llvm-profdata merge -o /dev/null %p/Inputs/malformed-ptr-to-counter-array.profraw 2>&1 | FileCheck %s
+
+CHECK: Malformed instrumentation profile data
-------------- next part --------------
A non-text attachment was scrubbed...
Name: D66979.218545.patch
Type: text/x-patch
Size: 2633 bytes
Desc: not available
URL: <http://lists.llvm.org/pipermail/llvm-commits/attachments/20190903/b608a70f/attachment.bin>
More information about the llvm-commits
mailing list