[BitcodeReader] It's a malformed block if CodeLenWidth is too big

Bug found with AFL fuzz.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@237646 91177308-0d34-0410-b5e6-96231b3b80d8
This commit is contained in:
Filipe Cabecinhas
2015-05-19 00:34:17 +00:00
parent 09f87b4a7b
commit c3ccd67d72
3 changed files with 9 additions and 0 deletions

View File

@ -39,6 +39,10 @@ bool BitstreamCursor::EnterSubBlock(unsigned BlockID, unsigned *NumWordsP) {
// Get the codesize of this block.
CurCodeSize = ReadVBR(bitc::CodeLenWidth);
// We can't read more than MaxChunkSize at a time
if (CurCodeSize > MaxChunkSize)
return true;
SkipToFourByteBoundary();
unsigned NumWords = Read(bitc::BlockSizeWidth);
if (NumWordsP) *NumWordsP = NumWords;