[llvm] [Support] Added checks to ULEB128/SLEB128 decoding routines checks for pointer past the end of the buffer (PR #89843)
Marek Milkovič via llvm-commits
llvm-commits at lists.llvm.org
Tue Apr 23 15:54:49 PDT 2024
https://github.com/metthal created https://github.com/llvm/llvm-project/pull/89843
I've ran into this when trying to explore exports trie of Mach-O file. Eventually, one of the nodes seems to send me past the end of the buffer, which results in segfaults since `p` is not really equal to the `end` and is dereferenced right after this check.
Still trying to figure out whether I can share the Mach-O files somehow for the testing purposes, but for now I wanted to at least submit it without tests.
>From 61879457322ec34345eed0e1a4b99471eaf83f27 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marek=20Milkovi=C4=8D?= <marek.milkovic at gendigital.com>
Date: Wed, 24 Apr 2024 00:48:08 +0200
Subject: [PATCH] Added checks to ULEB128/SLEB128 decoding routines checks for
pointer past the end of the buffer
---
llvm/include/llvm/Support/LEB128.h | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/llvm/include/llvm/Support/LEB128.h b/llvm/include/llvm/Support/LEB128.h
index c4e741549f3ff1..62211d907a8508 100644
--- a/llvm/include/llvm/Support/LEB128.h
+++ b/llvm/include/llvm/Support/LEB128.h
@@ -135,7 +135,7 @@ inline uint64_t decodeULEB128(const uint8_t *p, unsigned *n = nullptr,
uint64_t Value = 0;
unsigned Shift = 0;
do {
- if (LLVM_UNLIKELY(p == end)) {
+ if (LLVM_UNLIKELY(p >= end)) {
if (error)
*error = "malformed uleb128, extends past end";
Value = 0;
@@ -170,7 +170,7 @@ inline int64_t decodeSLEB128(const uint8_t *p, unsigned *n = nullptr,
unsigned Shift = 0;
uint8_t Byte;
do {
- if (LLVM_UNLIKELY(p == end)) {
+ if (LLVM_UNLIKELY(p >= end)) {
if (error)
*error = "malformed sleb128, extends past end";
if (n)
More information about the llvm-commits
mailing list