diff --git a/llvm/lib/Object/WasmObjectFile.cpp b/llvm/lib/Object/WasmObjectFile.cpp index 40665d686cf93..6f89e183118d6 100644 --- a/llvm/lib/Object/WasmObjectFile.cpp +++ b/llvm/lib/Object/WasmObjectFile.cpp @@ -546,6 +546,9 @@ Error WasmObjectFile::parseLinkingSection(ReadContext &Ctx) { uint32_t Size = readVaruint32(Ctx); LLVM_DEBUG(dbgs() << "readSubsection type=" << int(Type) << " size=" << Size << "\n"); + if ((const uint8_t *)(Ctx.Ptr + Size) > OrigEnd) + return make_error("invalid segment size", + object_error::parse_failed); Ctx.End = Ctx.Ptr + Size; switch (Type) { case wasm::WASM_SYMBOL_TABLE: diff --git a/llvm/test/Object/Inputs/WASM/clusterfuzz-testcase-minimized-llvm-dwarfdump-fuzzer-4510378518511616 b/llvm/test/Object/Inputs/WASM/clusterfuzz-testcase-minimized-llvm-dwarfdump-fuzzer-4510378518511616 new file mode 100644 index 0000000000000..f49d5773ea45c Binary files /dev/null and b/llvm/test/Object/Inputs/WASM/clusterfuzz-testcase-minimized-llvm-dwarfdump-fuzzer-4510378518511616 differ diff --git a/llvm/unittests/Object/CMakeLists.txt b/llvm/unittests/Object/CMakeLists.txt index 81bc4a5577e68..399334b0e599e 100644 --- a/llvm/unittests/Object/CMakeLists.txt +++ b/llvm/unittests/Object/CMakeLists.txt @@ -19,6 +19,7 @@ add_llvm_unittest(ObjectTests SymbolSizeTest.cpp SymbolicFileTest.cpp XCOFFObjectFileTest.cpp + ObjectFuzzRegressions.cpp ) target_link_libraries(ObjectTests PRIVATE LLVMTestingSupport) diff --git a/llvm/unittests/Object/ObjectFuzzRegressions.cpp b/llvm/unittests/Object/ObjectFuzzRegressions.cpp new file mode 100644 index 0000000000000..c56c1ea13bd5c --- /dev/null +++ b/llvm/unittests/Object/ObjectFuzzRegressions.cpp @@ -0,0 +1,32 @@ +//===-- ObjectFuzzRegressions.cpp - Fuzz regression checking -------------===// +// +// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. +// See https://llvm.org/LICENSE.txt for license information. +// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception +// +//===----------------------------------------------------------------------===// + +#include "llvm/Object/ObjectFile.h" +#include "llvm/Testing/Support/Error.h" +#include "gtest/gtest.h" + +using namespace llvm; +using namespace llvm::object; + +TEST(ObjectFuzzRegressions, OSSFUZZ30308) { + // Regression test for + // https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30308 + const uint8_t data[47] = { + 0x00, 0x61, 0x73, 0x6d, 0x01, 0x00, 0x00, 0x00, 0x00, 0x10, 0x07, 0x6c, + 0x69, 0x6e, 0x6b, 0x69, 0x6e, 0x67, 0x02, 0x08, 0xe2, 0x29, 0x01, 0x01, + 0x02, 0xea, 0x06, 0xf9, 0xee, 0x28, 0xe1, 0x2b, 0x2f, 0x09, 0x00, 0xef, + 0xbf, 0xbf, 0x00, 0x00, 0xdd, 0x73, 0x66, 0x83, 0x7b, 0x00, 0x55}; + + std::string Payload(reinterpret_cast(data), sizeof(data)); + std::unique_ptr Buff = MemoryBuffer::getMemBuffer(Payload); + Expected> ObjOrErr = + ObjectFile::createObjectFile(Buff->getMemBufferRef()); + if (auto E = ObjOrErr.takeError()) { + consumeError(std::move(E)); + } +}