[llvm] [Object][Wasm] Fix off-by-one in data segment name index validation (PR #196338)

[KIM SO JUNG via llvm-commits]

https://github.com/sjg-388 updated https://github.com/llvm/llvm-project/pull/196338

>From ab3cad165d92530fbc9bcc657cb779ee8efe5ed0 Mon Sep 17 00:00:00 2001
From: sjg-388 <sjg.388t at gmail.com>
Date: Thu, 7 May 2026 23:38:40 +0900
Subject: [PATCH 1/2] [Object][Wasm] Fix off-by-one in data segment name index
 validation

The check 'Index > DataSegments.size()' allows Index == DataSegments.size(),
which is an out-of-bounds access. In an assertions-disabled ASan build, this
causes a heap-buffer-overflow READ in parseNameSection().

Fix by using '>=' instead of '>'.
---
 llvm/lib/Object/WasmObjectFile.cpp            |  2 +-
 .../wasm/invalid-data-segment-name-index.test | 25 +++++++++++++++++++
 2 files changed, 26 insertions(+), 1 deletion(-)
 create mode 100644 llvm/test/tools/llvm-readobj/wasm/invalid-data-segment-name-index.test

diff --git a/llvm/lib/Object/WasmObjectFile.cpp b/llvm/lib/Object/WasmObjectFile.cpp
index 5f125ffb10198..f485095814157 100644
--- a/llvm/lib/Object/WasmObjectFile.cpp
+++ b/llvm/lib/Object/WasmObjectFile.cpp
@@ -600,7 +600,7 @@ Error WasmObjectFile::parseNameSection(ReadContext &Ctx) {
           if (!SeenSegments.insert(Index).second)
             return make_error<GenericBinaryError>(
                 "segment named more than once", object_error::parse_failed);
-          if (Index > DataSegments.size())
+          if (static_cast<size_t>(Index) >= DataSegments.size())
             return make_error<GenericBinaryError>("invalid data segment name entry",
                                                   object_error::parse_failed);
           nameType = wasm::NameType::DATA_SEGMENT;
diff --git a/llvm/test/tools/llvm-readobj/wasm/invalid-data-segment-name-index.test b/llvm/test/tools/llvm-readobj/wasm/invalid-data-segment-name-index.test
new file mode 100644
index 0000000000000..b32c0feaef7ec
--- /dev/null
+++ b/llvm/test/tools/llvm-readobj/wasm/invalid-data-segment-name-index.test
@@ -0,0 +1,25 @@
+# RUN: yaml2obj %s -o %t.wasm
+# RUN: not llvm-readobj --symbols %t.wasm 2>&1 | FileCheck %s
+
+# CHECK: error: '{{.*}}': invalid data segment name entry
+
+--- !WASM
+FileHeader:
+  Version:         0x1
+Sections:
+  - Type:            MEMORY
+    Memories:
+      - Minimum:     0x1
+  - Type:            DATA
+    Segments:
+      - SectionOffset:   0
+        InitFlags:       0
+        Offset:
+          Opcode:        I32_CONST
+          Value:         0
+        Content:         ''
+  - Type:            CUSTOM
+    Name:            name
+    DataSegmentNames:
+      - Index:        1
+        Name:         invalid_data_segment_name

>From fe325c4e5353631e989827177aa63db397c6f5a6 Mon Sep 17 00:00:00 2001
From: sjg-388 <sjg.388t at gmail.com>
Date: Fri, 8 May 2026 17:17:00 +0900
Subject: [PATCH 2/2] Remove unnecessary cast in data segment name index check

---
 llvm/lib/Object/WasmObjectFile.cpp | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/llvm/lib/Object/WasmObjectFile.cpp b/llvm/lib/Object/WasmObjectFile.cpp
index f485095814157..98f60bd710c7e 100644
--- a/llvm/lib/Object/WasmObjectFile.cpp
+++ b/llvm/lib/Object/WasmObjectFile.cpp
@@ -600,7 +600,7 @@ Error WasmObjectFile::parseNameSection(ReadContext &Ctx) {
           if (!SeenSegments.insert(Index).second)
             return make_error<GenericBinaryError>(
                 "segment named more than once", object_error::parse_failed);
-          if (static_cast<size_t>(Index) >= DataSegments.size())
+          if (Index >= DataSegments.size())
             return make_error<GenericBinaryError>("invalid data segment name entry",
                                                   object_error::parse_failed);
           nameType = wasm::NameType::DATA_SEGMENT;
@@ -833,7 +833,7 @@ Error WasmObjectFile::parseLinkingSectionSymtab(ReadContext &Ctx) {
         auto Offset = readVaruint64(Ctx);
         auto Size = readVaruint64(Ctx);
         if (!(Info.Flags & wasm::WASM_SYMBOL_ABSOLUTE)) {
-          if (static_cast<size_t>(Index) >= DataSegments.size())
+          if (Index >= DataSegments.size())
             return make_error<GenericBinaryError>(
                 "invalid data segment index: " + Twine(Index),
                 object_error::parse_failed);