RPCS3/llvm-mirror
1
0
Fork 0
mirror of https://github.com/RPCS3/llvm-mirror.git synced 2025-01-31 12:41:49 +01:00
Code Issues Projects Releases Wiki Activity

[CGP] Ensure address scaled offset is representable as int64_t

Browse Source 
AddressingModeMatcher::matchScaledValue was calling getSExtValue for a constant before ensuring that we can actually represent the value as int64_t

Fixes OSSFuzz#22723 which is a followup to rGc479052a74b2 (PR46004 / OSSFuzz#22357)
This commit is contained in:
Simon Pilgrim 2020-05-29 12:25:27 +01:00
parent a604bdd390
commit 104d358d14
2 changed files with 18 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
lib/CodeGen/CodeGenPrepare.cpp
View File

@ -3715,10 +3715,11 @@ bool AddressingModeMatcher::matchScaledValue(Value *ScaleReg, int64_t Scale,
// X*Scale + C*Scale to addr mode.
ConstantInt *CI = nullptr; Value *AddLHS = nullptr;
if (isa<Instruction>(ScaleReg) && // not a constant expr.
match(ScaleReg, m_Add(m_Value(AddLHS), m_ConstantInt(CI)))) {
match(ScaleReg, m_Add(m_Value(AddLHS), m_ConstantInt(CI))) &&
CI->getValue().isSignedIntN(64)) {
TestAddrMode.InBounds = false;
TestAddrMode.ScaledReg = AddLHS;
TestAddrMode.BaseOffs += CI->getSExtValue()*TestAddrMode.Scale;
TestAddrMode.BaseOffs += CI->getSExtValue() * TestAddrMode.Scale;
// If this addressing mode is legal, commit it and remember that we folded
// this instruction.

15
test/CodeGen/X86/pr46004.ll
View File

@ -19,3 +19,18 @@ define void @fuzz22357(i128 %a0) {
store i8 0, i8* %3, align 1
ret void
}
; OSS Fuzz: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22723
define void @fuzz22723(i128 %a0) {
; X86-LABEL: fuzz22723:
; X86: # %bb.0:
; X86-NEXT: retl
;
; X64-LABEL: fuzz22723:
; X64: # %bb.0:
; X64-NEXT: retq
%1 = add i128 %a0, 170141183460469231731687303715884105727
%2 = getelementptr i128*, i128** undef, i128 %1
store i128* undef, i128** %2, align 8
ret void
}