[compiler-rt] 10993bf - Bugfix for collecting features from very small DSOs.

[Marco Vanotti via llvm-commits]

Author: Aaron Green
Date: 2021-02-17T13:04:49-08:00
New Revision: 10993bf072d93cc0868b5594f8e22fb876139b41

URL: https://github.com/llvm/llvm-project/commit/10993bf072d93cc0868b5594f8e22fb876139b41
DIFF: https://github.com/llvm/llvm-project/commit/10993bf072d93cc0868b5594f8e22fb876139b41.diff

LOG: Bugfix for collecting features from very small DSOs.

During unit tests, it was observed that crafting an artificially small DSO could cause OOB memory to be accessed. This change fixes that (but again, the affected DSOs are unlikely to ever occur outside unit tests).

Reviewed By: morehouse, charco

Differential Revision: https://reviews.llvm.org/D94507

Added: 
    

Modified: 
    compiler-rt/lib/fuzzer/FuzzerTracePC.h

Removed: 
    


################################################################################
diff  --git a/compiler-rt/lib/fuzzer/FuzzerTracePC.h b/compiler-rt/lib/fuzzer/FuzzerTracePC.h
index 00909230731d..63b232062651 100644
--- a/compiler-rt/lib/fuzzer/FuzzerTracePC.h
+++ b/compiler-rt/lib/fuzzer/FuzzerTracePC.h
@@ -193,7 +193,7 @@ size_t ForEachNonZeroByte(const uint8_t *Begin, const uint8_t *End,
       Handle8bitCounter(FirstFeature, P - Begin, V);
 
   // Iterate by Step bytes at a time.
-  for (; P < End; P += Step)
+  for (; P + Step <= End; P += Step)
     if (LargeType Bundle = *reinterpret_cast<const LargeType *>(P)) {
       Bundle = HostToLE(Bundle);
       for (size_t I = 0; I < Step; I++, Bundle >>= 8)