PNaCl bitcode reader: restrict some record sizes

lib/Bitcode/NaCl/Reader/NaClBitcodeReader.cpp

 //===- NaClBitcodeReader.cpp ----------------------------------------------===//
 //     Internal NaClBitcodeReader implementation
 //
 //                     The LLVM Compiler Infrastructure
 //
 // This file is distributed under the University of Illinois Open Source
 // License. See LICENSE.TXT for details.
 //
 //===----------------------------------------------------------------------===//
 
@@ skipping 310 matching lines @@
     Type *ResultTy = 0;
     unsigned TypeCode = Stream.readRecord(Entry.ID, Record);
     switch (TypeCode) {
     default: {
       std::string Message;
       raw_string_ostream StrM(Message);
       StrM << "Unknown type code in type table: " << TypeCode;
       StrM.flush();
       return Error(Message);
     }
+
     case naclbitc::TYPE_CODE_NUMENTRY: // TYPE_CODE_NUMENTRY: [numentries]
       // TYPE_CODE_NUMENTRY contains a count of the number of types in the
       // type list.  This allows us to reserve space.
-      if (Record.size() < 1)
+      if (Record.size() != 1)
         return Error("Invalid TYPE_CODE_NUMENTRY record");
       TypeList.resize(Record[0]);
+      // No type was defined, skip the checks that follow the switch.
       continue;
-    case naclbitc::TYPE_CODE_VOID:      // VOID
+
+    case naclbitc::TYPE_CODE_VOID: // VOID
+      if (Record.size() != 0)
+        return Error("Invalid TYPE_CODE_VOID record");
       ResultTy = Type::getVoidTy(Context);
       break;
-    case naclbitc::TYPE_CODE_FLOAT:     // FLOAT
+
+    case naclbitc::TYPE_CODE_FLOAT: // FLOAT
+      if (Record.size() != 0)
+        return Error("Invalid TYPE_CODE_FLOAT record");
       ResultTy = Type::getFloatTy(Context);
       break;
-    case naclbitc::TYPE_CODE_DOUBLE:    // DOUBLE
+
+    case naclbitc::TYPE_CODE_DOUBLE: // DOUBLE
+      if (Record.size() != 0)
+        return Error("Invalid TYPE_CODE_DOUBLE record");
       ResultTy = Type::getDoubleTy(Context);
       break;
-    case naclbitc::TYPE_CODE_INTEGER:   // INTEGER: [width]
-      if (Record.size() < 1)
-        return Error("Invalid Integer type record");
 
+    case naclbitc::TYPE_CODE_INTEGER: // INTEGER: [width]
+      if (Record.size() != 1)
+        return Error("Invalid TYPE_CODE_INTEGER record");
       ResultTy = IntegerType::get(Context, Record[0]);
       break;
+
     case naclbitc::TYPE_CODE_FUNCTION: {
       // FUNCTION: [vararg, retty, paramty x N]
       if (Record.size() < 2)
-        return Error("Invalid FUNCTION type record");
-      SmallVector<Type*, 8> ArgTys;
+        return Error("Invalid TYPE_CODE_FUNCTION record");
+      SmallVector<Type *, 8> ArgTys;
       for (unsigned i = 2, e = Record.size(); i != e; ++i) {
         if (Type *T = getTypeByID(Record[i]))
           ArgTys.push_back(T);
         else
           break;
       }
 
       ResultTy = getTypeByID(Record[1]);
-      if (ResultTy == 0 || ArgTys.size() < Record.size()-2)
+      if (ResultTy == 0 || ArgTys.size() < Record.size() - 2)
         return Error("invalid type in function type");
 
       ResultTy = FunctionType::get(ResultTy, ArgTys, Record[0]);
       break;
     }
     }
 
     if (NumRecords >= TypeList.size())
       return Error("invalid TYPE table");
     assert(ResultTy && "Didn't read a type?");
@@ skipping 690 matching lines @@
       raw_string_ostream StrM(Message);
       StrM << "Unknown instruction record: <" << BitCode;
       for (unsigned I = 0, E = Record.size(); I != E; ++I) {
         StrM << " " << Record[I];
       }
       StrM << ">";
       return Error(StrM.str());
     }
 
     case naclbitc::FUNC_CODE_DECLAREBLOCKS:     // DECLAREBLOCKS: [nblocks]
-      if (Record.size() < 1 || Record[0] == 0)
+      if (Record.size() != 1 || Record[0] == 0)
         return Error("Invalid DECLAREBLOCKS record");
       // Create all the basic blocks for the function.
       FunctionBBs.resize(Record[0]);
       for (unsigned i = 0, e = FunctionBBs.size(); i != e; ++i) {
         BasicBlockInfo &BBInfo = FunctionBBs[i];
         BBInfo.BB = BasicBlock::Create(Context, "", F);
       }
       CurBB = FunctionBBs.at(0).BB;
       continue;
 
@@ skipping 49 matching lines @@
       break;
     }
 
     case naclbitc::FUNC_CODE_INST_VSELECT: {// VSELECT: [opval, opval, pred]
       // new form of select
       // handles select i1 or select [N x i1]
       unsigned OpNum = 0;
       Value *TrueVal, *FalseVal, *Cond;
       if (popValue(Record, &OpNum, NextValueNo, &TrueVal) ||
           popValue(Record, &OpNum, NextValueNo, &FalseVal) ||
-          popValue(Record, &OpNum, NextValueNo, &Cond))
+          popValue(Record, &OpNum, NextValueNo, &Cond) ||
+          OpNum != Record.size())
         return Error("Invalid SELECT record");
 
       TrueVal = ConvertOpToScalar(TrueVal, CurBBNo);
       FalseVal = ConvertOpToScalar(FalseVal, CurBBNo);
 
       // expect i1
       if (Cond->getType() != Type::getInt1Ty(Context))
         return Error("Invalid SELECT condition type");
 
       I = SelectInst::Create(Cond, TrueVal, FalseVal);
@@ skipping 152 matching lines @@
       Op = ConvertOpToType(Op, T->getPointerTo(), CurBBNo);
       if (Op == 0) return true;
       I = new LoadInst(Op, "", false, (1 << Record[OpNum]) >> 1);
       break;
     }
     case naclbitc::FUNC_CODE_INST_STORE: {
       // STORE: [ptr, val, align]
       unsigned OpNum = 0;
       Value *Val, *Ptr;
       if (popValue(Record, &OpNum, NextValueNo, &Ptr) ||
-          popValue(Record, &OpNum, NextValueNo, &Val))
-        return Error("Invalid STORE record");
-      if (OpNum+1 != Record.size())
+          popValue(Record, &OpNum, NextValueNo, &Val) ||
+          OpNum+1 != Record.size())
         return Error("Invalid STORE record");
       Val = ConvertOpToScalar(Val, CurBBNo);
       Ptr = ConvertOpToType(Ptr, Val->getType()->getPointerTo(), CurBBNo);
       I = new StoreInst(Val, Ptr, false, (1 << Record[OpNum]) >> 1);
       break;
     }
     case naclbitc::FUNC_CODE_INST_CALL:
     case naclbitc::FUNC_CODE_INST_CALL_INDIRECT: {
       // CALL: [cc, fnid, arg0, arg1...]
       // CALL_INDIRECT: [cc, fnid, fnty, args...]
@@ skipping 363 matching lines @@
   if (M->MaterializeAllPermanently(ErrMsg)) {
     delete M;
     return 0;
   }
 
   // TODO: Restore the use-lists to the in-memory state when the bitcode was
   // written.  We must defer until the Module has been fully materialized.
 
   return M;
 }