https://bugs.llvm.org/show_bug.cgi?id=46958
Bug ID: 46958
Summary: Out of boundary read in Unwind-EHABI.cpp
Product: Runtime Libraries
Version: trunk
Hardware: PC
OS: All
Status: NEW
Severity: normal
Priority: P
Component: libunwind
Assignee: unassignedb...@nondot.org
Reporter: leadro...@qq.com
CC: llvm-bugs@lists.llvm.org
File: llvm/llvm-project/blob/master/libunwind/src/Unwind-EHABI.cpp
Function: _Unwind_VRS_Interpret
Length of one bytecode can be 1 or 2 or more. There has been a boundary check
during interpreting in some of them, but still forget the others.
For example:
Intercept with check:
```
case 0xb1: {
if (offset >= len)
return _URC_FAILURE;
uint8_t registers = getByte(data, offset++);
if (registers & 0xf0 || !registers)
return _URC_FAILURE;
_Unwind_VRS_Pop(context, _UVRSC_CORE, registers, _UVRSD_UINT32);
break;
}
```
Intercept without check:
```
case 0xb3: {
uint8_t v = getByte(data, offset++);
_Unwind_VRS_Pop(context, _UVRSC_VFP,
RegisterRange(static_cast<uint8_t>(v >> 4),
v & 0x0f), _UVRSD_VFPX);
break;
}
```
I think case 0xb3 needs a boundary check. The same situation: 0xc6, 0xc7, 0xc8,
0xc9.
--
You are receiving this mail because:
You are on the CC list for the bug._______________________________________________
llvm-bugs mailing list
llvm-bugs@lists.llvm.org
https://lists.llvm.org/cgi-bin/mailman/listinfo/llvm-bugs
