Make sure that isValidElementType(Type) before calling {Array,Struct}Type::get(Type)

Bug found with AFL fuzz.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@236073 91177308-0d34-0410-b5e6-96231b3b80d8
This commit is contained in:
Filipe Cabecinhas 2015-04-29 01:27:01 +00:00
parent 2d6f83dac9
commit 3b4a565b8a
4 changed files with 11 additions and 2 deletions

View File

@ -1474,7 +1474,8 @@ std::error_code BitcodeReader::ParseTypeTableBody() {
case bitc::TYPE_CODE_ARRAY: // ARRAY: [numelts, eltty] case bitc::TYPE_CODE_ARRAY: // ARRAY: [numelts, eltty]
if (Record.size() < 2) if (Record.size() < 2)
return Error("Invalid record"); return Error("Invalid record");
if ((ResultTy = getTypeByID(Record[1]))) if ((ResultTy = getTypeByID(Record[1])) &&
StructType::isValidElementType(ResultTy))
ResultTy = ArrayType::get(ResultTy, Record[0]); ResultTy = ArrayType::get(ResultTy, Record[0]);
else else
return Error("Invalid type"); return Error("Invalid type");
@ -1482,7 +1483,8 @@ std::error_code BitcodeReader::ParseTypeTableBody() {
case bitc::TYPE_CODE_VECTOR: // VECTOR: [numelts, eltty] case bitc::TYPE_CODE_VECTOR: // VECTOR: [numelts, eltty]
if (Record.size() < 2) if (Record.size() < 2)
return Error("Invalid record"); return Error("Invalid record");
if ((ResultTy = getTypeByID(Record[1]))) if ((ResultTy = getTypeByID(Record[1])) &&
StructType::isValidElementType(ResultTy))
ResultTy = VectorType::get(ResultTy, Record[0]); ResultTy = VectorType::get(ResultTy, Record[0]);
else else
return Error("Invalid type"); return Error("Invalid type");

Binary file not shown.

Binary file not shown.

View File

@ -98,3 +98,10 @@ RUN: not llvm-dis -disable-output %p/Inputs/invalid-fwdref-type-mismatch.bc 2>&1
RUN: FileCheck --check-prefix=FWDREF-TYPE %s RUN: FileCheck --check-prefix=FWDREF-TYPE %s
FWDREF-TYPE: Invalid record FWDREF-TYPE: Invalid record
RUN: not llvm-dis -disable-output %p/Inputs/invalid-array-element-type.bc 2>&1 | \
RUN: FileCheck --check-prefix=ELEMENT-TYPE %s
RUN: not llvm-dis -disable-output %p/Inputs/invalid-vector-element-type.bc 2>&1 | \
RUN: FileCheck --check-prefix=ELEMENT-TYPE %s
ELEMENT-TYPE: Invalid type