[llvm] [BitcodeReader] Avoid integer overflow in strtab bounds check (PR #228786)

[Prasad Deshpande via llvm-commits]

https://github.com/Prasad-desh created https://github.com/llvm/llvm-project/pull/228786

`BitcodeReaderBase::readNameFromStrtab` validates a name reference with
`Record[0] + Record[1] > Strtab.size()`. Both operands are 64-bit values read
directly from the input file, so the addition can wrap: a large `strtab_offset`
makes the sum small enough to pass the check, after which the function returns a
`StringRef` at `Strtab.data() + Record[0]` with length `Record[1]`, pointing
outside the string table. Any later read of that name is out of bounds.

The check is rephrased so neither side can overflow: reject when the record is
too short, when the offset alone exceeds the table, or when the length exceeds
the bytes remaining after the offset. The subtraction is guarded by the
preceding offset check and cannot underflow.

Valid references and honest (non-wrapping) out-of-bounds references are
unaffected; only the wrapping case changes, from accepted to rejected. I
modelled the old and new conditions side by side over benign, non-wrapping
out-of-bounds, and wrapping inputs to confirm there is no other behaviour change.

The `Record.size() < 2` guard is included because every caller reaches this
function before checking the record's length, so a short record would otherwise
index `Record[0]`/`Record[1]` unchecked.

No test is included. Exercising this path needs a malformed bitcode input and I
would rather not hand-craft one; happy to add a regression test if there is a
suitable OSS-Fuzz reproducer for this function, or if a reviewer would prefer a
particular form. I have also not run a full local LLVM build — this is a
conditional rephrase inside one function with no other call sites affected, so
I am relying on CI for the build.

Prepared with AI assistance (Claude); I reviewed the change myself.

>From 33d07d9bca29d9b280bfcfbec69fcb28b1ca5039 Mon Sep 17 00:00:00 2001
From: Prasad Deshpande <74897556+Prasad-desh at users.noreply.github.com>
Date: Sun, 4 Oct 2026 04:48:42 +0530
Subject: [PATCH 1/2] [BitcodeReader] Avoid integer overflow in strtab bounds
 check

---
 llvm/lib/Bitcode/Reader/BitcodeReader.cpp | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/llvm/lib/Bitcode/Reader/BitcodeReader.cpp b/llvm/lib/Bitcode/Reader/BitcodeReader.cpp
index 70a69a32d7d6f..9209edd1d2b64 100644
--- a/llvm/lib/Bitcode/Reader/BitcodeReader.cpp
+++ b/llvm/lib/Bitcode/Reader/BitcodeReader.cpp
@@ -3,7 +3,6 @@
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
-//
 //===----------------------------------------------------------------------===//
 
 #include "llvm/Bitcode/BitcodeReader.h"
@@ -483,7 +482,11 @@ BitcodeReaderBase::readNameFromStrtab(ArrayRef<uint64_t> Record) {
   if (!UseStrtab)
     return {"", Record};
   // Invalid reference. Let the caller complain about the record being empty.
-  if (Record[0] + Record[1] > Strtab.size())
+  // Both values are read from the file. Compare without adding them: the sum
+  // wraps for a large strtab_offset, which would pass this check and yield a
+  // StringRef pointing outside the string table.
+  if (Record.size() < 2 || Record[0] > Strtab.size() ||
+      Record[1] > Strtab.size() - Record[0])
     return {"", {}};
   return {StringRef(Strtab.data() + Record[0], Record[1]), Record.slice(2)};
 }

>From 914e81fcbd519591c8e1aa5a51b0965cf69a8779 Mon Sep 17 00:00:00 2001
From: Prasad Deshpande <74897556+Prasad-desh at users.noreply.github.com>
Date: Sun, 4 Oct 2026 04:50:34 +0530
Subject: [PATCH 2/2] Restore the license header line removed in error

---
 llvm/lib/Bitcode/Reader/BitcodeReader.cpp | 1 +
 1 file changed, 1 insertion(+)

diff --git a/llvm/lib/Bitcode/Reader/BitcodeReader.cpp b/llvm/lib/Bitcode/Reader/BitcodeReader.cpp
index 9209edd1d2b64..75c857f706af1 100644
--- a/llvm/lib/Bitcode/Reader/BitcodeReader.cpp
+++ b/llvm/lib/Bitcode/Reader/BitcodeReader.cpp
@@ -3,6 +3,7 @@
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
 //===----------------------------------------------------------------------===//
 
 #include "llvm/Bitcode/BitcodeReader.h"