[MachO] Improve bounds check #141083
[MachO] Improve bounds check #141083
Conversation
The current check may fail if the addition overflows. I've observed failures of macho-invalid.test on 32-bit due to this. Instead, compare against the remaining bytes until the end of the object.
|
@llvm/pr-subscribers-llvm-binary-utilities Author: Nikita Popov (nikic) ChangesThe current check may fail if the addition overflows. I've observed failures of macho-invalid.test on 32-bit due to this. Instead, compare against the remaining bytes until the end of the object. Full diff: https://github.com/llvm/llvm-project/pull/141083.diff 1 Files Affected:
diff --git a/llvm/lib/Object/MachOObjectFile.cpp b/llvm/lib/Object/MachOObjectFile.cpp
index 69d36e6a77db7..5db264207ffb7 100644
--- a/llvm/lib/Object/MachOObjectFile.cpp
+++ b/llvm/lib/Object/MachOObjectFile.cpp
@@ -192,7 +192,8 @@ static Expected<MachOObjectFile::LoadCommandInfo>
getLoadCommandInfo(const MachOObjectFile &Obj, const char *Ptr,
uint32_t LoadCommandIndex) {
if (auto CmdOrErr = getStructOrErr<MachO::load_command>(Obj, Ptr)) {
- if (CmdOrErr->cmdsize + Ptr > Obj.getData().end())
+ assert(Ptr <= Obj.getData().end() && "Start must be before end");
+ if (CmdOrErr->cmdsize > (uintptr_t)(Obj.getData().end() - Ptr))
return malformedError("load command " + Twine(LoadCommandIndex) +
" extends past end of file");
if (CmdOrErr->cmdsize < 8)
|
|
/cherry-pick 3f29acb |
|
Failed to create pull request for issue141083 https://github.com/llvm/llvm-project/actions/runs/15249073515 |
1 similar comment
|
Failed to create pull request for issue141083 https://github.com/llvm/llvm-project/actions/runs/15249073515 |
|
/cherry-pick 3f29acb |
|
Oh, it looks like there's an API outage: https://www.githubstatus.com/incidents/d0nm3xcdc5jw |
|
/cherry-pick 3f29acb |
|
Heh, looks like the PR creation actually worked but posting the comment failed: #141461 |
The current check may fail if the addition overflows. I've observed failures of macho-invalid.test on 32-bit due to this. Instead, compare against the remaining bytes until the end of the object. (cherry picked from commit 3f29acb)
The current check may fail if the addition overflows. I've observed failures of macho-invalid.test on 32-bit due to this. Instead, compare against the remaining bytes until the end of the object.
The current check may fail if the addition overflows. I've observed failures of macho-invalid.test on 32-bit due to this.
Instead, compare against the remaining bytes until the end of the object.