[llvm] [BitcodeReader] Avoid integer overflow in strtab bounds check (PR #228786)

[Prasad Deshpande via llvm-commits]

https://github.com/Prasad-desh updated https://github.com/llvm/llvm-project/pull/228786

>From ef3118018388f791983eae6c211bcf95962ee5ab Mon Sep 17 00:00:00 2001
From: Prasad Deshpande <officiallyprasad at gmail.com>
Date: Sun, 4 Oct 2026 18:01:03 +0000
Subject: [PATCH] [BitcodeReader] Avoid integer overflow in strtab bounds check

Assisted-by: Claude (Anthropic)
---
 llvm/lib/Bitcode/Reader/BitcodeReader.cpp | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/llvm/lib/Bitcode/Reader/BitcodeReader.cpp b/llvm/lib/Bitcode/Reader/BitcodeReader.cpp
index 70a69a32d7d6f..75c857f706af1 100644
--- a/llvm/lib/Bitcode/Reader/BitcodeReader.cpp
+++ b/llvm/lib/Bitcode/Reader/BitcodeReader.cpp
@@ -483,7 +483,11 @@ BitcodeReaderBase::readNameFromStrtab(ArrayRef<uint64_t> Record) {
   if (!UseStrtab)
     return {"", Record};
   // Invalid reference. Let the caller complain about the record being empty.
-  if (Record[0] + Record[1] > Strtab.size())
+  // Both values are read from the file. Compare without adding them: the sum
+  // wraps for a large strtab_offset, which would pass this check and yield a
+  // StringRef pointing outside the string table.
+  if (Record.size() < 2 || Record[0] > Strtab.size() ||
+      Record[1] > Strtab.size() - Record[0])
     return {"", {}};
   return {StringRef(Strtab.data() + Record[0], Record[1]), Record.slice(2)};
 }