[BinaryFormat] Fix out of bounds read.

Found by OSS-FUZZ!
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3220

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@312238 91177308-0d34-0410-b5e6-96231b3b80d8

diff --git a/lib/BinaryFormat/Magic.cpp b/lib/BinaryFormat/Magic.cpp
index b19a07a9066b059ca2949aafbb90fd9f7193d450..e9b8df93b90281b77825a83627b4d32e0f8f2870 100644 (file)
--- a/lib/BinaryFormat/Magic.cpp
+++ b/lib/BinaryFormat/Magic.cpp
@@ -182,7 +182,7 @@ file_magic llvm::identify_magic(StringRef Magic) {
     break;
 
   case 'M': // Possible MS-DOS stub on Windows PE file
-    if (startswith(Magic, "MZ")) {
+    if (startswith(Magic, "MZ") && Magic.size() >= 0x3c + 4) {
       uint32_t off = read32le(Magic.data() + 0x3c);
       // PE/COFF file, either EXE or DLL.
       if (off < Magic.size() &&

diff --git a/unittests/BinaryFormat/TestFileMagic.cpp b/unittests/BinaryFormat/TestFileMagic.cpp
index 68b3ade0095436e163f59845ac21c08b91d7646b..ca4ca9a272814781d311d8b345bac2a928910a46 100644 (file)
--- a/unittests/BinaryFormat/TestFileMagic.cpp
+++ b/unittests/BinaryFormat/TestFileMagic.cpp
@@ -80,6 +80,7 @@ const char windows_resource[] =
     "\x00\x00\x00\x00\x020\x00\x00\x00\xff\xff\x00\x00\xff\xff\x00\x00";
 const char macho_dynamically_linked_shared_lib_stub[] =
     "\xfe\xed\xfa\xce........\x00\x00\x00\x09............";
+const char ms_dos_stub_broken[] = "\x4d\x5a\x20\x20";
 
 TEST_F(MagicTest, Magic) {
   struct type {
@@ -108,7 +109,9 @@ TEST_F(MagicTest, Magic) {
       DEFINE(macho_dynamically_linked_shared_lib_stub),
       DEFINE(macho_dsym_companion),
       DEFINE(macho_kext_bundle),
-      DEFINE(windows_resource)
+      DEFINE(windows_resource),
+      {"ms_dos_stub_broken", ms_dos_stub_broken, sizeof(ms_dos_stub_broken),
+       file_magic::unknown},
 #undef DEFINE
   };