[llvm] [Object][Wasm] Guard relocation diagnostics against out-of-range indexes (PR #204872)

[KIM SO JUNG via llvm-commits]

https://github.com/sjg-388 updated https://github.com/llvm/llvm-project/pull/204872

>From 0d4506a1ff73568dd572990838559c1b4c56024c Mon Sep 17 00:00:00 2001
From: sjg-388 <sjg.388t at gmail.com>
Date: Sun, 17 May 2026 19:11:25 +0900
Subject: [PATCH] [Object][Wasm] Guard relocation diagnostics against
 out-of-range indexes

The badReloc lambda in parseRelocSection() accesses Symbols[Reloc.Index]
when building diagnostic messages, even after validation has determined
that Reloc.Index is out of range. This causes a heap out-of-bounds read
that can crash LLVM tools or disclose process-internal string data through
diagnostic output.

Fix by checking Reloc.Index against Symbols.size() before dereferencing,
and emit the numeric index in the error message when out of range.

The vulnerable diagnostic path is shared across multiple relocation type
validation failures, including R_WASM_FUNCTION_INDEX_LEB,
R_WASM_TAG_INDEX_LEB, R_WASM_TABLE_NUMBER_LEB, and R_WASM_MEMORY_ADDR_LEB.
---
 llvm/lib/Object/WasmObjectFile.cpp        |  4 +++
 llvm/test/Object/Wasm/bad-relocation.yaml | 30 +++++++++++++++++++++++
 2 files changed, 34 insertions(+)

diff --git a/llvm/lib/Object/WasmObjectFile.cpp b/llvm/lib/Object/WasmObjectFile.cpp
index 98f60bd710c7e..2a2eb59df6e52 100644
--- a/llvm/lib/Object/WasmObjectFile.cpp
+++ b/llvm/lib/Object/WasmObjectFile.cpp
@@ -1058,6 +1058,10 @@ Error WasmObjectFile::parseRelocSection(StringRef Name, ReadContext &Ctx) {
                                             object_error::parse_failed);
 
     auto badReloc = [&](StringRef msg) {
+      if (Reloc.Index >= Symbols.size())
+        return make_error<GenericBinaryError>(
+            msg + ": index " + Twine(Reloc.Index) + " out of range",
+            object_error::parse_failed);
       return make_error<GenericBinaryError>(
           msg + ": " + Twine(Symbols[Reloc.Index].Info.Name),
           object_error::parse_failed);
diff --git a/llvm/test/Object/Wasm/bad-relocation.yaml b/llvm/test/Object/Wasm/bad-relocation.yaml
index aed405c328b61..e0dc88f50d865 100644
--- a/llvm/test/Object/Wasm/bad-relocation.yaml
+++ b/llvm/test/Object/Wasm/bad-relocation.yaml
@@ -1,3 +1,6 @@
+# RUN: yaml2obj %s --docnum=2 | not llvm-objdump -s - 2>&1 | FileCheck %s --check-prefix=OOB
+# OOB: invalid function relocation: index 13 out of range
+# OOB-NOT: dot-cfg-quiet
 # RUN: yaml2obj %s | not llvm-objdump -s - 2>&1 | FileCheck %s
 
 # Check for invalid relocations.  In this case we have a relocations of type
@@ -33,3 +36,30 @@ Sections:
         Segment:         0
         Offset:          0
         Size:            1
+--- !WASM
+FileHeader:
+  Version:         0x00000001
+Sections:
+  - Type:            DATA
+    Segments:
+      - SectionOffset:   0
+        InitFlags:       0
+        Offset:
+          Opcode:          I32_CONST
+          Value:           0
+        Content:         '6401020304'
+    Relocations:
+      - Type:            R_WASM_FUNCTION_INDEX_LEB
+        Index:           13
+        Offset:          0x00000000
+  - Type:            CUSTOM
+    Name:            linking
+    Version:         2
+    SymbolTable:
+      - Index:           0
+        Kind:            DATA
+        Name:            foo
+        Flags:           [ ]
+        Segment:         0
+        Offset:          0
+        Size:            1