Commit Graph

42 Commits

Author SHA1 Message Date
Rafael Espindola
9afb3a2589 Fix for PR23310: llvm-dis crashes when trying to upgrade an intrinsic.
When trying to upgrade @llvm.x86.sse2.psrl.dq while parsing a module,
BitcodeReader adds the function to its worklist twice, resulting in a
crash when accessing it the second time.

This patch replaces the worklist vector by a map.

Patch by Philip Pfaffe.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@241281 91177308-0d34-0410-b5e6-96231b3b80d8
2015-07-02 16:22:40 +00:00
Rafael Espindola
0c650627ca Improve handling of end of file in the bitcode reader.
Before this patch the bitcode reader would read a module from a file
that contained in order:

* Any number of non MODULE_BLOCK sub blocks.
* One MODULE_BLOCK
* Any number of non MODULE_BLOCK sub blocks.
* 4 '\n' characters to handle OS X's ranlib.

Since we support lazy reading of modules, any information that is relevant
for the module has to be in the MODULE_BLOCK or before it. We don't gain
anything from checking what is after.

This patch then changes the reader to stop once the MODULE_BLOCK has been
successfully parsed.

This avoids the ugly special case for .bc files in an archive and makes it
easier to embed bitcode files.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@239845 91177308-0d34-0410-b5e6-96231b3b80d8
2015-06-16 20:03:39 +00:00
Rafael Espindola
0021a54ae5 Add a test for padded bitcode files.
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@239829 91177308-0d34-0410-b5e6-96231b3b80d8
2015-06-16 16:36:15 +00:00
Filipe Cabecinhas
a3a2cab504 [BitcodeReader] Diagnose type mismatches with aliases
Bug found with AFL fuzz.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@238895 91177308-0d34-0410-b5e6-96231b3b80d8
2015-06-03 01:30:13 +00:00
Filipe Cabecinhas
1a2a0ee8a0 [Bitcode] Minimize the test to not conflict with others
Source for the test:
@bloom = global <3 x i32> <i32 0, i32 1, i32 42>

Plus bit twiddling to set the vector numelts to 0 (in the bc file).

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@238894 91177308-0d34-0410-b5e6-96231b3b80d8
2015-06-03 01:30:08 +00:00
Filipe Cabecinhas
287f68d654 [BitcodeReader] Check vector size before trying to create a VectorType
Bug found with AFL fuzz

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@238891 91177308-0d34-0410-b5e6-96231b3b80d8
2015-06-03 00:05:30 +00:00
Filipe Cabecinhas
3b821159da [BitcodeReader] Change an assert to a call to a call to Error()
It's reachable from user input.

Bug found with AFL fuzz.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@238633 91177308-0d34-0410-b5e6-96231b3b80d8
2015-05-30 00:17:20 +00:00
Filipe Cabecinhas
1c0b496636 [BitcodeReader] Change assert to report_fatal_error
It can be triggered by user input.

Bug found with AFL fuzz.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@238272 91177308-0d34-0410-b5e6-96231b3b80d8
2015-05-27 01:05:40 +00:00
Filipe Cabecinhas
316f9e05ce [BitstreamReader] Make sure the Array operand type is an encoding
Bug found with AFL fuzz.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@238269 91177308-0d34-0410-b5e6-96231b3b80d8
2015-05-27 00:48:43 +00:00
Filipe Cabecinhas
c756772b8d [BitcodeReader] Make sure abbrev records have at least one operand (record code)
Bug found with AFL fuzz.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@238265 91177308-0d34-0410-b5e6-96231b3b80d8
2015-05-26 23:52:21 +00:00
Filipe Cabecinhas
1c74d4768a [BitcodeReader] Sanity check on Comdat ID
Shouldn't be an assert, since user input can trigger it.

Bug found with AFL fuzz.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@238261 91177308-0d34-0410-b5e6-96231b3b80d8
2015-05-26 23:00:56 +00:00
Filipe Cabecinhas
27ca64f3d3 Change a reachable unreachable to a fatal error.
Summary:
Also tagged a FIXME comment, and added information about why it breaks.

Bug found using AFL fuzz.

Reviewers: rafael, craig.topper

Subscribers: llvm-commits

Differential Revision: http://reviews.llvm.org/D9729

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@237709 91177308-0d34-0410-b5e6-96231b3b80d8
2015-05-19 18:18:10 +00:00
Filipe Cabecinhas
bf27e11e02 [BitcodeReader] Error out if we read an invalid function argument type
Bug found with AFL fuzz.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@237650 91177308-0d34-0410-b5e6-96231b3b80d8
2015-05-19 01:21:06 +00:00
Filipe Cabecinhas
c3ccd67d72 [BitcodeReader] It's a malformed block if CodeLenWidth is too big
Bug found with AFL fuzz.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@237646 91177308-0d34-0410-b5e6-96231b3b80d8
2015-05-19 00:34:17 +00:00
Filipe Cabecinhas
b2bf278152 [BitcodeReader] Make sure the type of the inserted value matches the type of the aggregate at those indices
Bug found with AFL-fuzz.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@237628 91177308-0d34-0410-b5e6-96231b3b80d8
2015-05-18 22:27:11 +00:00
Filipe Cabecinhas
70a2c7260a Extract the load/store type verification to a separate function.
Summary:
Added isLoadableOrStorableType to PointerType.

We were doing some checks in some places, occasionally assert()ing instead
of telling the caller. With this patch, I'm putting all type checking in
the same place for load/store type instructions, and verifying the same
thing every time.

I also added a check for load/store of a function type.

Applied extracted check to Load, Store, and Cmpxcg.

I don't have exhaustive tests for all of these, but all Error() calls in
TypeCheckLoadStoreInst are being tested (in invalid.test).

Reviewers: dblaikie, rafael

Subscribers: llvm-commits

Differential Revision: http://reviews.llvm.org/D9785

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@237619 91177308-0d34-0410-b5e6-96231b3b80d8
2015-05-18 21:48:55 +00:00
Filipe Cabecinhas
ddf553bb8d [BitcodeReader] Don't allow INSERTVAL/EXTRACTVAL with 0 indices
This would trigger an assertion later.

Bug found with AFL fuzz.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@237494 91177308-0d34-0410-b5e6-96231b3b80d8
2015-05-16 00:33:12 +00:00
Filipe Cabecinhas
deedba2a36 Don't overflow GCTable
Summary: Bug found with AFL fuzz.

Reviewers: rafael, dexonsmith

Subscribers: llvm-commits

Differential Revision: http://reviews.llvm.org/D9361

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@236200 91177308-0d34-0410-b5e6-96231b3b80d8
2015-04-30 04:09:41 +00:00
Filipe Cabecinhas
8b2199e2a2 Make sure Op->getType() is a PointerType before we cast<> it.
Bug found with AFL fuzz.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@236193 91177308-0d34-0410-b5e6-96231b3b80d8
2015-04-30 01:13:31 +00:00
Filipe Cabecinhas
a607be94ca Make sure we don't resize(0) when we get a fwdref with Idx == UINT_MAX
Make it an error instead.

Bug found with AFL fuzz.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@236190 91177308-0d34-0410-b5e6-96231b3b80d8
2015-04-30 00:52:42 +00:00
Filipe Cabecinhas
99ebc9e004 Check that we have a valid PointerType element type before calling get()
Same as r236073 but for PointerType.

Bug found with AFL fuzz.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@236079 91177308-0d34-0410-b5e6-96231b3b80d8
2015-04-29 02:27:28 +00:00
Filipe Cabecinhas
7b30f32d3d Turn an assert into report_fatal_error since it's reachable based on user input
Bug found with AFL fuzz.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@236076 91177308-0d34-0410-b5e6-96231b3b80d8
2015-04-29 01:58:31 +00:00
Filipe Cabecinhas
3b4a565b8a Make sure that isValidElementType(Type) before calling {Array,Struct}Type::get(Type)
Bug found with AFL fuzz.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@236073 91177308-0d34-0410-b5e6-96231b3b80d8
2015-04-29 01:27:01 +00:00
Filipe Cabecinhas
7acbf56112 Relax an assert when there's a type mismatch in forward references
Summary:
We don't seem to need to assert here, since this function's callers expect
to get a nullptr on error. This way we don't assert on user input.

Bug found with AFL fuzz.

Reviewers: rafael

Subscribers: llvm-commits

Differential Revision: http://reviews.llvm.org/D9308

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@236027 91177308-0d34-0410-b5e6-96231b3b80d8
2015-04-28 20:18:47 +00:00
David Blaikie
c5b1f0a49d [opaque pointer type] bitcode: add explicit callee type to invoke instructions
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@235735 91177308-0d34-0410-b5e6-96231b3b80d8
2015-04-24 18:06:06 +00:00
Filipe Cabecinhas
45a69610a7 [BitcodeReader] Fix asserts when we read a non-vector type for insert/extract/shuffle
Added some additional checking for vector types + tests.

Bug found with AFL fuzz.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@235710 91177308-0d34-0410-b5e6-96231b3b80d8
2015-04-24 11:30:15 +00:00
Filipe Cabecinhas
0236022390 Be more strict about the operand for the array type in BitcodeReader
Summary: Bug found with AFL fuzz.

Reviewers: rafael

Subscribers: llvm-commits

Differential Revision: http://reviews.llvm.org/D9016

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@235596 91177308-0d34-0410-b5e6-96231b3b80d8
2015-04-23 13:38:21 +00:00
Filipe Cabecinhas
81f9bd3e19 Verify sizes when trying to read a BitcodeAbbrevOp
Summary:
Make sure the abbrev operands are valid and that we can read/skip them
afterwards.

Bug found with AFL fuzz.

Reviewers: rafael

Subscribers: llvm-commits

Differential Revision: http://reviews.llvm.org/D9030

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@235595 91177308-0d34-0410-b5e6-96231b3b80d8
2015-04-23 13:25:35 +00:00
Filipe Cabecinhas
e16cac587a Have more strict type checks when creating BinOp nodes in BitcodeReader
Summary: Bug found with AFL.

Reviewers: rafael, bkramer

Subscribers: llvm-commits

Differential Revision: http://reviews.llvm.org/D9015

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@235489 91177308-0d34-0410-b5e6-96231b3b80d8
2015-04-22 09:06:21 +00:00
David Blaikie
5023f151a7 [opaque pointer type] Explicit pointee type for call instruction
Use an extra bit in the CCInfo to flag the newer version of the
instructiont hat includes the type explicitly.

Tested the newer error cases I added, but didn't add tests for the finer
granularity improvements to existing error paths.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@235160 91177308-0d34-0410-b5e6-96231b3b80d8
2015-04-17 06:40:14 +00:00
Filipe Cabecinhas
f72ee4c275 Revert "Verify sizes when trying to read a VBR"
This reverts r234984 since it seems to break some bots (most of them
seemed arm*-selfhost).

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@234998 91177308-0d34-0410-b5e6-96231b3b80d8
2015-04-15 11:10:17 +00:00
Filipe Cabecinhas
4c0055402f Verify sizes when trying to read a VBR
Also added an assert to ReadVBR64.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@234984 91177308-0d34-0410-b5e6-96231b3b80d8
2015-04-15 08:48:08 +00:00
Filipe Cabecinhas
9a1030a4d6 Error out of ParseBitcodeInto(Module*) if we haven't read a Module
Summary:
Without this check the following case failed:

Skip a SubBlock which is not a MODULE_BLOCK_ID nor a BLOCKINFO_BLOCK_ID
Got to end of file

TheModule would still be == nullptr, and we would subsequentially fail
when materializing the Module (assert at the start of
BitcodeReader::MaterializeModule).

Bug found with AFL.

Reviewers: dexonsmith, rafael

Subscribers: llvm-commits

Differential Revision: http://reviews.llvm.org/D9014

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@234887 91177308-0d34-0410-b5e6-96231b3b80d8
2015-04-14 14:07:15 +00:00
David Blaikie
712d00bc64 Add testing for mismatched explicit type on a gep operator when loading from bitcode
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@232427 91177308-0d34-0410-b5e6-96231b3b80d8
2015-03-16 22:03:50 +00:00
David Blaikie
2a83bf6228 Add testing for mismatched explicit type on a load instruction when loading from bitcode
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@232424 91177308-0d34-0410-b5e6-96231b3b80d8
2015-03-16 21:48:46 +00:00
David Blaikie
f1d4614418 Test bitcode parsing error-handling for incorrect explicit type
(turns out I had regressed this when sinking handling of this type down
into GetElementPtrInst::Create - since that asserted before the error
handling was performed)

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@232420 91177308-0d34-0410-b5e6-96231b3b80d8
2015-03-16 21:35:48 +00:00
JF Bastien
8c253f7e88 Use common parse routine to read alignment values from bitcode
While fuzzing LLVM bitcode files, I discovered that (1) the bitcode reader doesn't check that alignments are no larger than 2**29; (2) downstream code doesn't check the range; and (3) for values out of range, corresponding large memory requests (based on alignment size) will fail. This code fixes the bitcode reader to check for valid alignments, fixing this problem.

This CL fixes alignment value on global variables, functions, and instructions: alloca, load, load atomic, store, store atomic.

Patch by Karl Schimpf (kschimpf@google.com).

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@230180 91177308-0d34-0410-b5e6-96231b3b80d8
2015-02-22 19:32:03 +00:00
Filipe Cabecinhas
9183d13f45 [Bitcode reader] Fix a few assertions when reading invalid files
Summary:
When creating {insert,extract}value instructions from a BitcodeReader, we
weren't verifying the fields were valid.

Bugs found with afl-fuzz

Reviewers: rafael

Subscribers: llvm-commits

Differential Revision: http://reviews.llvm.org/D7325

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@229345 91177308-0d34-0410-b5e6-96231b3b80d8
2015-02-16 00:03:11 +00:00
Filipe Cabecinhas
1897b5c08c Check bit widths before trying to get a type.
Added a test case for it.
Also added run lines for the test case in r227566.

Bugs found with afl-fuzz

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@227589 91177308-0d34-0410-b5e6-96231b3b80d8
2015-01-30 18:13:50 +00:00
Filipe Cabecinhas
8cf149dbad [bitcode reader] Fix an assert on invalid type tables
Bug found with afl-fuzz

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@227566 91177308-0d34-0410-b5e6-96231b3b80d8
2015-01-30 10:57:58 +00:00
Filipe Cabecinhas
5d8bb5c7c5 [Bitcode] Diagnose errors instead of asserting from bad input
Eventually we can make some of these pass the error along to the caller.

Reports a fatal error if:
We find an invalid abbrev record
We try to get an invalid abbrev number
We can't fill the current word due to an EOF

Fixed an invalid bitcode test to check for output with FileCheck

Bugs found with afl-fuzz

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@226986 91177308-0d34-0410-b5e6-96231b3b80d8
2015-01-24 04:15:05 +00:00
Filipe Cabecinhas
293d3deea3 Use report_fatal_error instead of llvm_unreachable, so we don't crash on user input
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@226248 91177308-0d34-0410-b5e6-96231b3b80d8
2015-01-16 04:54:12 +00:00