https://llvm.org/bugs/show_bug.cgi?id=24661
Bug ID: 24661
Summary: heap-buffer-overflow in
llvm::InlineAsm::ConstraintInfo::Parse
Product: new-bugs
Version: unspecified
Hardware: PC
OS: Linux
Status: NEW
Severity: normal
Priority: P
Component: new bugs
Assignee: unassignedb...@nondot.org
Reporter: k...@google.com
CC: kschi...@google.com, llvm-bugs@lists.llvm.org
Blocks: 24639
Classification: Unclassified
Found with libFuzzer
echo
Cgp0YXJnZXQgZGF0YWxheW91dCA9ICJFLW06ZS1pNjQ6NjQtbjMyOjY0Igp0YXJnZXQgdHJpcGxlID0gInBvd2VycGM2NC11bmtub3duLWxpbnV4LWdudSIKCmRlZmluZSB6ZXJvZXh0IGkxIEB0ZXN0aTEoaTEgemVyb2V4dCAlYjEsIGkxIHplcm9leHQgJWIyKSAjMCB7CmVudHJ5OgogICUwID0gdGFpbCBjYWxsIGk4IGFzbSAiY3JhbmQgJDAsICQxLCAkNiIsICI9XndjLF4sd3djXmMiKGkxICViMSwgaTEgJWIyKQoKCgkKdGEgIzAKICAlMSA9IGFucmQgaTggJTAsIDEKICAldG9ib29sMyA9IGljbXAgbmUgaTggJTEsIDAKICByZXQgaTEgJXRvYm9vbDMKCgoKCgoKCgoKCn0KCmRlZmluZSBzaWduZXh0IGkzMiBAdGVzdGkzMihpMzIgc2lnbmV4dCAlYjEsIGkzMiBzaWduZXh0ICViMikgIzAgewpnZW50cnk=
| base64 --decode | ./bin/llvm-as -
==23108==ERROR: AddressSanitizer: heap-buffer-overflow on address
0x60400000da75 at pc 0x0000009e036f bp 0x7fff83bff1f0 sp 0x7fff83bff1e8
READ of size 1 at 0x60400000da75 thread T0
#0 0x9e036e in llvm::InlineAsm::ConstraintInfo::Parse(llvm::StringRef,
std::vector<llvm::InlineAsm::ConstraintInfo,
std::allocator<llvm::InlineAsm::ConstraintInfo> >&) lib/IR/InlineAsm.cpp:141:9
#1 0x9e0c53 in llvm::InlineAsm::ParseConstraints(llvm::StringRef)
lib/IR/InlineAsm.cpp:220:9
#2 0x9da693 in llvm::InlineAsm::Verify(llvm::FunctionType*,
llvm::StringRef) lib/IR/InlineAsm.cpp:247:38
#3 0x56eef0 in llvm::LLParser::ConvertValIDToValue(llvm::Type*,
llvm::ValID&, llvm::Value*&, llvm::LLParser::PerFunctionState*,
llvm::LLParser::OperatorConstraint) lib/AsmParser/LLParser.cpp:4133:10
#4 0x5b86b7 in llvm::LLParser::ParseCall(llvm::Instruction*&,
llvm::LLParser::PerFunctionState&, llvm::CallInst::TailCallKind)
lib/AsmParser/LLParser.cpp:5593:7
#5 0x599c5b in llvm::LLParser::ParseInstruction(llvm::Instruction*&,
llvm::BasicBlock*, llvm::LLParser::PerFunctionState&)
lib/AsmParser/LLParser.cpp:4770:35
#6 0x59809d in
llvm::LLParser::ParseBasicBlock(llvm::LLParser::PerFunctionState&)
lib/AsmParser/LLParser.cpp:4630:13
#7 0x5272e9 in llvm::LLParser::ParseFunctionBody(llvm::Function&)
lib/AsmParser/LLParser.cpp:4578:9
#8 0x50880d in llvm::LLParser::ParseDefine()
lib/AsmParser/LLParser.cpp:411:10
#9 0x5010f1 in llvm::LLParser::ParseTopLevelEntities()
lib/AsmParser/LLParser.cpp:217:33
#10 0x500b31 in llvm::LLParser::Run() lib/AsmParser/LLParser.cpp:48:10
#11 0x4e0f91 in llvm::parseAssemblyInto(llvm::MemoryBufferRef,
llvm::Module&, llvm::SMDiagnostic&, llvm::SlotMapping*)
lib/AsmParser/Parser.cpp:31:10
#12 0x4e204a in parseAssembly lib/AsmParser/Parser.cpp:41:7
#13 0x4e204a in llvm::parseAssemblyFile(llvm::StringRef,
llvm::SMDiagnostic&, llvm::LLVMContext&, llvm::SlotMapping*)
lib/AsmParser/Parser.cpp:59
#14 0x4dd7f0 in main tools/llvm-as/llvm-as.cpp:96:31
#15 0x7fbdb792bec4 in __libc_start_main
/build/buildd/eglibc-2.19/csu/libc-start.c:287
#16 0x424d7b in _start
(/usr/local/google/home/kcc/llvm-asan-cov-assertions/bin/llvm-as+0x424d7b)
0x60400000da75 is located 0 bytes to the right of 37-byte region
[0x60400000da50,0x60400000da75)
allocated by thread T0 here:
#0 0x4da85b in operator new(unsigned long)
projects/compiler-rt/lib/asan/asan_new_delete.cc:62:35
#1 0x7fbdb7f9d668 in __gnu_cxx::new_allocator<char>::allocate(unsigned
long, void const*)
/usr/local/google/home/kcc/tmp/gcc-4.8.2/build/x86_64-unknown-linux-gnu/libstdc++-v3/include/ext/new_allocator.h:104
#2 0x7fbdb7f9d668 in std::string::_Rep::_S_create(unsigned long, unsigned
long, std::allocator<char> const&)
/usr/local/google/home/kcc/tmp/gcc-4.8.2/build/x86_64-unknown-linux-gnu/libstdc++-v3/include/bits/basic_string.tcc:607
#3 0x5b794c in llvm::LLParser::ParseCall(llvm::Instruction*&,
llvm::LLParser::PerFunctionState&, llvm::CallInst::TailCallKind)
lib/AsmParser/LLParser.cpp:5566:7
#4 0x599c5b in llvm::LLParser::ParseInstruction(llvm::Instruction*&,
llvm::BasicBlock*, llvm::LLParser::PerFunctionState&)
lib/AsmParser/LLParser.cpp:4770:35
#5 0x59809d in
llvm::LLParser::ParseBasicBlock(llvm::LLParser::PerFunctionState&)
lib/AsmParser/LLParser.cpp:4630:13
#6 0x5272e9 in llvm::LLParser::ParseFunctionBody(llvm::Function&)
lib/AsmParser/LLParser.cpp:4578:9
#7 0x50880d in llvm::LLParser::ParseDefine()
lib/AsmParser/LLParser.cpp:411:10
#8 0x5010f1 in llvm::LLParser::ParseTopLevelEntities()
lib/AsmParser/LLParser.cpp:217:33
#9 0x500b31 in llvm::LLParser::Run() lib/AsmParser/LLParser.cpp:48:10
#10 0x4e0f91 in llvm::parseAssemblyInto(llvm::MemoryBufferRef,
llvm::Module&, llvm::SMDiagnostic&, llvm::SlotMapping*)
lib/AsmParser/Parser.cpp:31:10
#11 0x4e204a in parseAssembly lib/AsmParser/Parser.cpp:41:7
#12 0x4e204a in llvm::parseAssemblyFile(llvm::StringRef,
llvm::SMDiagnostic&, llvm::LLVMContext&, llvm::SlotMapping*)
lib/AsmParser/Parser.cpp:59
#13 0x4dd7f0 in main tools/llvm-as/llvm-as.cpp:96:31
#14 0x7fbdb792bec4 in __libc_start_main
/build/buildd/eglibc-2.19/csu/libc-start.c:287
--
You are receiving this mail because:
You are on the CC list for the bug.
_______________________________________________
llvm-bugs mailing list
llvm-bugs@lists.llvm.org
http://lists.llvm.org/cgi-bin/mailman/listinfo/llvm-bugs
