[llvm] [Support] Added checks to ULEB128/SLEB128 decoding routines checks for pointer past the end of the buffer (PR #89843)

Marek Milkovič via llvm-commits llvm-commits at lists.llvm.org
Tue Apr 23 15:54:49 PDT 2024


https://github.com/metthal created https://github.com/llvm/llvm-project/pull/89843

I've ran into this when trying to explore exports trie of Mach-O file. Eventually, one of the nodes seems to send me past the end of the buffer, which results in segfaults since `p` is not really equal to the `end` and is dereferenced right after this check.

Still trying to figure out whether I can share the Mach-O files somehow for the testing purposes, but for now I wanted to at least submit it without tests.

>From 61879457322ec34345eed0e1a4b99471eaf83f27 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marek=20Milkovi=C4=8D?= <marek.milkovic at gendigital.com>
Date: Wed, 24 Apr 2024 00:48:08 +0200
Subject: [PATCH] Added checks to ULEB128/SLEB128 decoding routines checks for
 pointer past the end of the buffer

---
 llvm/include/llvm/Support/LEB128.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/llvm/include/llvm/Support/LEB128.h b/llvm/include/llvm/Support/LEB128.h
index c4e741549f3ff1..62211d907a8508 100644
--- a/llvm/include/llvm/Support/LEB128.h
+++ b/llvm/include/llvm/Support/LEB128.h
@@ -135,7 +135,7 @@ inline uint64_t decodeULEB128(const uint8_t *p, unsigned *n = nullptr,
   uint64_t Value = 0;
   unsigned Shift = 0;
   do {
-    if (LLVM_UNLIKELY(p == end)) {
+    if (LLVM_UNLIKELY(p >= end)) {
       if (error)
         *error = "malformed uleb128, extends past end";
       Value = 0;
@@ -170,7 +170,7 @@ inline int64_t decodeSLEB128(const uint8_t *p, unsigned *n = nullptr,
   unsigned Shift = 0;
   uint8_t Byte;
   do {
-    if (LLVM_UNLIKELY(p == end)) {
+    if (LLVM_UNLIKELY(p >= end)) {
       if (error)
         *error = "malformed sleb128, extends past end";
       if (n)



More information about the llvm-commits mailing list