Skip to content

Commit b0e683e

Browse files
committed
[llvm][MachO] Fix infinite loop parsing bind table
`MachOBindEntry::moveNext()` assumes that the bind table ends with `BIND_OPCODE_DONE` or a bind (`BIND_OPCODE_DO_BIND[_*]`). However a valid bind table might also end with other effectively no-op opcodes, which caused the parser to move past the end and go into the next table (weak bind table) and bounced back in a loop.
1 parent 419d363 commit b0e683e

File tree

3 files changed

+413
-7
lines changed

3 files changed

+413
-7
lines changed

llvm/lib/Object/MachOObjectFile.cpp

Lines changed: 9 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -3838,15 +3838,17 @@ void MachOBindEntry::moveNext() {
38383838
--RemainingLoopCount;
38393839
return;
38403840
}
3841-
// BIND_OPCODE_DONE is only used for padding if we are not aligned to
3842-
// pointer size. Therefore it is possible to reach the end without ever having
3843-
// seen BIND_OPCODE_DONE.
3844-
if (Ptr == Opcodes.end()) {
3845-
Done = true;
3846-
return;
3847-
}
3841+
38483842
bool More = true;
38493843
while (More) {
3844+
// BIND_OPCODE_DONE is only used for padding if we are not aligned to
3845+
// pointer size. Therefore it is possible to reach the end without ever
3846+
// having seen BIND_OPCODE_DONE.
3847+
if (Ptr == Opcodes.end()) {
3848+
Done = true;
3849+
return;
3850+
}
3851+
38503852
// Parse next opcode and set up next loop.
38513853
const uint8_t *OpcodeStart = Ptr;
38523854
uint8_t Byte = *Ptr++;

0 commit comments

Comments
 (0)