[llvm] [Object][Wasm] Fix off-by-one in data segment name index validation (PR #196338)

[KIM SO JUNG via llvm-commits]

https://github.com/sjg-388 created https://github.com/llvm/llvm-project/pull/196338

The check `Index > DataSegments.size()` in `parseNameSection()` allows
`Index == DataSegments.size()`, which is an out-of-bounds access.

In an assertions-disabled ASan build, a malformed wasm object with one
data segment and a data segment name entry using index 1 triggers a
heap-buffer-overflow READ in `WasmObjectFile::parseNameSection()`.

Fix by checking `Index >= DataSegments.size()` instead.

Also add a regression test that verifies the malformed input is rejected
with "invalid data segment name entry".

>From 4e20503d5e9432b9a3d8c38d7661ef17bb590b9e Mon Sep 17 00:00:00 2001
From: sjg-388 <sjg.388t at gmail.com>
Date: Thu, 7 May 2026 23:38:40 +0900
Subject: [PATCH] [Object][Wasm] Fix off-by-one in data segment name index
 validation

The check 'Index > DataSegments.size()' allows Index == DataSegments.size(),
which is an out-of-bounds access. In an assertions-disabled ASan build, this
causes a heap-buffer-overflow READ in parseNameSection().

Fix by using '>=' instead of '>'.
---
 llvm/lib/Object/WasmObjectFile.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/llvm/lib/Object/WasmObjectFile.cpp b/llvm/lib/Object/WasmObjectFile.cpp
index 5f125ffb10198..f485095814157 100644
--- a/llvm/lib/Object/WasmObjectFile.cpp
+++ b/llvm/lib/Object/WasmObjectFile.cpp
@@ -600,7 +600,7 @@ Error WasmObjectFile::parseNameSection(ReadContext &Ctx) {
           if (!SeenSegments.insert(Index).second)
             return make_error<GenericBinaryError>(
                 "segment named more than once", object_error::parse_failed);
-          if (Index > DataSegments.size())
+          if (static_cast<size_t>(Index) >= DataSegments.size())
             return make_error<GenericBinaryError>("invalid data segment name entry",
                                                   object_error::parse_failed);
           nameType = wasm::NameType::DATA_SEGMENT;