Merge pull request #175 from haberman/fuzz

Fixed bug found by fuzzing.
google · Nov 4, 2019 · c45138f · c45138f
2 parents f8e2914 + 7a4fef7
commit c45138f
Showing 1 changed file with 9 additions and 3 deletions.
diff --git a/src/macho.cc b/src/macho.cc
@@ -87,13 +87,19 @@ void AdvancePastStruct(string_view* data) {
   *data = data->substr(sizeof(T));
 }
 
-string_view ReadNullTerminated(string_view data) {
+string_view ReadNullTerminated(string_view data, size_t offset) {
+  if (offset >= data.size()) {
+    THROW("Invalid Mach-O string table offset.");
+  }
+
+  data = data.substr(offset);
+
   const char* nullz =
       static_cast<const char*>(memchr(data.data(), '\0', data.size()));
 
   // Return false if not NULL-terminated.
   if (nullz == NULL) {
-    THROW("DWARF string was not NULL-terminated");
+    THROW("Mach-O string was not NULL-terminated");
   }
 
   size_t len = nullz - data.data();
@@ -445,7 +451,7 @@ void ParseSymbolsFromSymbolTable(const LoadCommand& cmd, SymbolTable* table,
       continue;
     }
 
-    string_view name = ReadNullTerminated(strtab.substr(sym->n_un.n_strx));
+    string_view name = ReadNullTerminated(strtab, sym->n_un.n_strx);
 
     if (sink->data_source() >= DataSource::kSymbols) {
       sink->AddVMRange("macho_symbols", sym->n_value, RangeSink::kUnknownSize,