From cdaea4db269646e25b97e8139a37849303c56e92 Mon Sep 17 00:00:00 2001 From: Greg Fitzgerald Date: Thu, 19 Feb 2015 20:42:23 +0000 Subject: [PATCH] Fix heap-buffer-overflow bugs identified by the Address Sanitizer Differential Revision: http://reviews.llvm.org/D7733 llvm-svn: 229912 --- lld/lib/ReaderWriter/MachO/ArchHandler.cpp | 2 ++ lld/lib/ReaderWriter/MachO/CompactUnwindPass.cpp | 3 +++ 2 files changed, 5 insertions(+) diff --git a/lld/lib/ReaderWriter/MachO/ArchHandler.cpp b/lld/lib/ReaderWriter/MachO/ArchHandler.cpp index 90c838c..cb20907 100644 --- a/lld/lib/ReaderWriter/MachO/ArchHandler.cpp +++ b/lld/lib/ReaderWriter/MachO/ArchHandler.cpp @@ -142,6 +142,8 @@ uint32_t ArchHandler::readU32(const uint8_t *addr, bool isBig) { bool ArchHandler::isDwarfCIE(bool isBig, const DefinedAtom *atom) { assert(atom->contentType() == DefinedAtom::typeCFI); + if (atom->rawContent().size() < sizeof(uint32_t)) + return false; uint32_t size = read32(atom->rawContent().data(), isBig); uint32_t idOffset = sizeof(uint32_t); diff --git a/lld/lib/ReaderWriter/MachO/CompactUnwindPass.cpp b/lld/lib/ReaderWriter/MachO/CompactUnwindPass.cpp index 40b257c..74b013f 100644 --- a/lld/lib/ReaderWriter/MachO/CompactUnwindPass.cpp +++ b/lld/lib/ReaderWriter/MachO/CompactUnwindPass.cpp @@ -411,6 +411,9 @@ private: } } + if (atom->rawContent().size() < 4 * sizeof(uint32_t)) + return entry; + using normalized::read32; entry.rangeLength = read32(atom->rawContent().data() + 2 * sizeof(uint32_t), _isBig); -- 2.7.4