replica
/
hanchenye-llvm-project
2
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Bounds check the number of bitmap blocks in the name map 

llvm-svn: 271105
This commit is contained in:
David Majnemer 2016-05-28 05:59:25 +00:00
parent a429581787
commit 869631f987
1 changed files with 10 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
llvm/lib/DebugInfo/PDB/Raw/NameMap.cpp
View File

@ -50,6 +50,8 @@ Error NameMap::load(codeview::StreamReader &Stream) {
make_error<RawError>(raw_error_code::corrupt_file, make_error<RawError>(raw_error_code::corrupt_file,
"Expected name map max strings")); "Expected name map max strings"));
const uint32_t MaxNumberOfWords = UINT32_MAX / sizeof(uint32_t);
// This appears to be a hash table which uses bitfields to determine whether // This appears to be a hash table which uses bitfields to determine whether
// or not a bucket is 'present'. // or not a bucket is 'present'.
uint32_t NumPresentWords; uint32_t NumPresentWords;
@ -58,6 +60,10 @@ Error NameMap::load(codeview::StreamReader &Stream) {
make_error<RawError>(raw_error_code::corrupt_file, make_error<RawError>(raw_error_code::corrupt_file,
"Expected name map num words")); "Expected name map num words"));
if (NumPresentWords > MaxNumberOfWords)
return make_error<RawError>(raw_error_code::corrupt_file,
"Number of present words is too large");
// Store all the 'present' bits in a vector for later processing. // Store all the 'present' bits in a vector for later processing.
SmallVector<uint32_t, 1> PresentWords; SmallVector<uint32_t, 1> PresentWords;
for (uint32_t I = 0; I != NumPresentWords; ++I) { for (uint32_t I = 0; I != NumPresentWords; ++I) {
@ -79,6 +85,10 @@ Error NameMap::load(codeview::StreamReader &Stream) {
make_error<RawError>(raw_error_code::corrupt_file, make_error<RawError>(raw_error_code::corrupt_file,
"Expected name map num deleted words")); "Expected name map num deleted words"));
if (NumDeletedWords > MaxNumberOfWords)
return make_error<RawError>(raw_error_code::corrupt_file,
"Number of deleted words is too large");
// Store all the 'deleted' bits in a vector for later processing. // Store all the 'deleted' bits in a vector for later processing.
SmallVector<uint32_t, 1> DeletedWords; SmallVector<uint32_t, 1> DeletedWords;
for (uint32_t I = 0; I != NumDeletedWords; ++I) { for (uint32_t I = 0; I != NumDeletedWords; ++I) {