Specially crafted bitcode wrapper headers can cause unsigned interger
overflow and lead to crashes when wrapping around. Fix the offset check
and avoid such scenarios.
Writing a testcase for this would involve editing the binary to generate
values that trigger the overflow, since this would never happen while
generating the bitcode in regular compilation flows, so there's
currently no feasible way add one.
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@268881
91177308-0d34-0410-b5e6-
96231b3b80d8
unsigned Offset = support::endian::read32le(&BufPtr[BWH_OffsetField]);
unsigned Size = support::endian::read32le(&BufPtr[BWH_SizeField]);
+ uint64_t BitcodeOffsetEnd = (uint64_t)Offset + (uint64_t)Size;
// Verify that Offset+Size fits in the file.
- if (VerifyBufferSize && Offset+Size > unsigned(BufEnd-BufPtr))
+ if (VerifyBufferSize && BitcodeOffsetEnd > uint64_t(BufEnd-BufPtr))
return true;
BufPtr += Offset;
BufEnd = BufPtr+Size;