[llvm] e8b6fa5 - [WebAssembly] Add bounds check in parseCodeSection (#76407)

[via llvm-commits]

Author: DavidKorczynski
Date: 2023-12-26T13:32:13-08:00
New Revision: e8b6fa5f301de4688b7a4bd6c41d30f29f0e2ddd

URL: https://github.com/llvm/llvm-project/commit/e8b6fa5f301de4688b7a4bd6c41d30f29f0e2ddd
DIFF: https://github.com/llvm/llvm-project/commit/e8b6fa5f301de4688b7a4bd6c41d30f29f0e2ddd.diff

LOG: [WebAssembly] Add bounds check in parseCodeSection (#76407)

This is needed as otherwise `Ctx.Ptr` will be incremented to a position
outside it's available buffer, which is being used to read values e.g.
https://github.com/llvm/llvm-project/blob/966d564e43e650b9c34f9c67829d3947f52add91/llvm/lib/Object/WasmObjectFile.cpp#L1469

Fixes: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28856

Signed-off-by: David Korczynski <david at adalogics.com>

Added: 
    

Modified: 
    llvm/lib/Object/WasmObjectFile.cpp

Removed: 
    


################################################################################
diff  --git a/llvm/lib/Object/WasmObjectFile.cpp b/llvm/lib/Object/WasmObjectFile.cpp
index dfe86a45df3227..40665d686cf939 100644
--- a/llvm/lib/Object/WasmObjectFile.cpp
+++ b/llvm/lib/Object/WasmObjectFile.cpp
@@ -1484,6 +1484,11 @@ Error WasmObjectFile::parseCodeSection(ReadContext &Ctx) {
     }
 
     uint32_t BodySize = FunctionEnd - Ctx.Ptr;
+    // Ensure that Function is within Ctx's buffer.
+    if (Ctx.Ptr + BodySize > Ctx.End) {
+      return make_error<GenericBinaryError>("Function extends beyond buffer",
+                                            object_error::parse_failed);
+    }
     Function.Body = ArrayRef<uint8_t>(Ctx.Ptr, BodySize);
     // This will be set later when reading in the linking metadata section.
     Function.Comdat = UINT32_MAX;