Mitch Phillips 6f43255edb Fix buffer-overflow in llvm-mt's notify_update feature. ...

The 3-parameter std::equal used in this code access FileBuffer from [0,
OutputBuffer->getBufferEnd() - OutputBuffer->getBufferStart()). If the
size of FileBuffer is shorter than OutputBuffer, this ends up
overflowing.

This wasn't found on the sanitizer buildbots as they use an instrumented
libcxx, and libcxx implements std::equal using a loop. libstdc++ on my
local macine finds the bug, as it implements std::equal using bcmp(),
which ASan intercepts and does a range check.

The existing test doesn't technically do a buffer-overflow, but the code
definitely can. If OutputBuffer was "AAABBB" and FileBuffer was "AAA",
then the code would overflow.

Reviewed By: abrachet

Differential Revision: https://reviews.llvm.org/D139457

2022-12-06 13:45:57 -08:00

..

CMakeLists.txt

[llvm-driver] Add various tools to the llvm-driver

2022-10-06 05:16:13 +00:00

llvm-mt.cpp

Fix buffer-overflow in llvm-mt's notify_update feature.

2022-12-06 13:45:57 -08:00

Opts.td

…