From f9ce75bf1830d5488211ede06be71d08c694dcf3 Mon Sep 17 00:00:00 2001 From: Vedant Kumar Date: Mon, 23 Oct 2017 18:04:34 +0000 Subject: [wasm] readSection: Avoid reading past eof (fixes oss-fuzz #3219) A wasm file crafted with a bogus section size can trigger an ASan issue in the DWARFObjInMemory constructor. Nip the problem in the bud when we read the wasm section. Found by OSS-Fuzz: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3219 Differential Revision: https://reviews.llvm.org/D38777 git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@316357 91177308-0d34-0410-b5e6-96231b3b80d8 --- lib/Object/WasmObjectFile.cpp | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) (limited to 'lib/Object') diff --git a/lib/Object/WasmObjectFile.cpp b/lib/Object/WasmObjectFile.cpp index 15a78df5402..86ce9c2209c 100644 --- a/lib/Object/WasmObjectFile.cpp +++ b/lib/Object/WasmObjectFile.cpp @@ -178,14 +178,16 @@ static wasm::WasmTable readTable(const uint8_t *&Ptr) { } static Error readSection(WasmSection &Section, const uint8_t *&Ptr, - const uint8_t *Start) { - // TODO(sbc): Avoid reading past EOF in the case of malformed files. + const uint8_t *Start, const uint8_t *Eof) { Section.Offset = Ptr - Start; Section.Type = readVaruint7(Ptr); uint32_t Size = readVaruint32(Ptr); if (Size == 0) return make_error("Zero length section", object_error::parse_failed); + if (Ptr + Size > Eof) + return make_error("Section too large", + object_error::parse_failed); Section.Content = ArrayRef(Ptr, Size); Ptr += Size; return Error::success(); @@ -221,7 +223,7 @@ WasmObjectFile::WasmObjectFile(MemoryBufferRef Buffer, Error &Err) WasmSection Sec; while (Ptr < Eof) { - if ((Err = readSection(Sec, Ptr, getPtr(0)))) + if ((Err = readSection(Sec, Ptr, getPtr(0), Eof))) return; if ((Err = parseSection(Sec))) return; -- cgit v1.2.3