diff options
| author | Filipe Cabecinhas <me@filcab.net> | 2015-05-26 23:00:56 +0000 |
|---|---|---|
| committer | Filipe Cabecinhas <me@filcab.net> | 2015-05-26 23:00:56 +0000 |
| commit | 1c74d4768af8a17e46768662d5551a7553a49747 (patch) | |
| tree | d3b389bdcf6c10f000ba524379c03c0fbc839231 /lib/Bitcode | |
| parent | 116e31ffbeaa5e8ecadab944ca246ee0317da199 (diff) | |
| download | llvm-1c74d4768af8a17e46768662d5551a7553a49747.tar.gz | |
[BitcodeReader] Sanity check on Comdat ID
Shouldn't be an assert, since user input can trigger it.
Bug found with AFL fuzz.
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@238261 91177308-0d34-0410-b5e6-96231b3b80d8
Diffstat (limited to 'lib/Bitcode')
| -rw-r--r-- | lib/Bitcode/Reader/BitcodeReader.cpp | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/lib/Bitcode/Reader/BitcodeReader.cpp b/lib/Bitcode/Reader/BitcodeReader.cpp index 6eef594eaf19..3f21bb9fbac3 100644 --- a/lib/Bitcode/Reader/BitcodeReader.cpp +++ b/lib/Bitcode/Reader/BitcodeReader.cpp @@ -2956,7 +2956,8 @@ std::error_code BitcodeReader::ParseModule(bool Resume, if (Record.size() > 11) { if (unsigned ComdatID = Record[11]) { - assert(ComdatID <= ComdatList.size()); + if (ComdatID > ComdatList.size()) + return Error("Invalid global variable comdat ID"); NewGV->setComdat(ComdatList[ComdatID - 1]); } } else if (hasImplicitComdat(RawLinkage)) { @@ -3020,7 +3021,8 @@ std::error_code BitcodeReader::ParseModule(bool Resume, if (Record.size() > 12) { if (unsigned ComdatID = Record[12]) { - assert(ComdatID <= ComdatList.size()); + if (ComdatID > ComdatList.size()) + return Error("Invalid function comdat ID"); Func->setComdat(ComdatList[ComdatID - 1]); } } else if (hasImplicitComdat(RawLinkage)) { |