This fixes a crash with invalid bitcode files that have records
referencing names in Strtab, but Strtab is not present or the index is
out-of-bounds.
This fixes the following clusterfuzz issue:
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29895
Reviewed By: arsenm
Differential Revision: https://reviews.llvm.org/D95554
// Record[16] is the address space number.
- // Check whether we have enough values to read a partition name.
- if (Record.size() > 18)
+ // Check whether we have enough values to read a partition name. Also make
+ // sure Strtab has enough values.
+ if (Record.size() > 18 && Strtab.data() &&
+ Record[17] + Record[18] <= Strtab.size()) {
Func->setPartition(StringRef(Strtab.data() + Record[17], Record[18]));
+ }
ValueList.push_back(Func);
--- /dev/null
+; Bitcode with an invalid record that indexes a name outside of strtab.
+
+; RUN: not llvm-dis %s.bc -o - 2>&1 | FileCheck %s
+
+; CHECK: error: Invalid record