bound cf_table reads when building the cfg and call graph

centipede/call_graph.cc

@@ -43,18 +43,18 @@ void CallGraph::InitializeCallGraph(const CFTable &cf_table,
     if (IsFunctionEntry(current_pc)) current_function_entry = current_pc;
 
     // Iterate over successors.
-    while (cf_table[j]) {
+    while (j < cf_table.size() && cf_table[j]) {
       ++j;
     }
     ++j;  // Step over the delimeter.
 
     // Iterate over callees.
-    while (cf_table[j]) {
+    while (j < cf_table.size() && cf_table[j]) {
       current_callees.push_back(cf_table[j]);
       ++j;
     }
     ++j;  // Step over the delimeter.
-    FUZZTEST_CHECK_LE(j, cf_table.size());
+    FUZZTEST_CHECK_LE(j, cf_table.size()) << "Malformed CF table";
 
     if (current_callees.empty()) continue;
     basic_block_callees_[current_pc] = current_callees;

centipede/call_graph_test.cc

@@ -72,6 +72,15 @@ TEST(CallGraphDeathTest, CgNoneExistentPc) {
   EXPECT_DEATH(call_graph.GetBasicBlockCallees(666), "");
 }
 
+TEST(CallGraphDeathTest, CgTruncatedCfTable) {
+  // The record for PC 1 is missing both of its delimiters, which is what a
+  // partially written cf-table file looks like.
+  static const CFTable truncated_cf_table = {1, 2, 3};
+  CallGraph call_graph;
+  EXPECT_DEATH(call_graph.InitializeCallGraph(truncated_cf_table, g_pc_table),
+               "Malformed CF table");
+}
+
 TEST(CallGraph, BuildCgFromCfTable) {
   CallGraph call_graph;
   call_graph.InitializeCallGraph(g_cf_table, g_pc_table);

centipede/control_flow.cc

@@ -145,7 +145,7 @@ void ControlFlowGraph::InitializeControlFlowGraph(const CFTable &cf_table,
     ++j;
 
     // Iterate over successors.
-    while (cf_table[j]) {
+    while (j < cf_table.size() && cf_table[j]) {
       successors.push_back(cf_table[j]);
       ++j;
     }
@@ -157,11 +157,11 @@ void ControlFlowGraph::InitializeControlFlowGraph(const CFTable &cf_table,
     FUZZTEST_VLOG(100) << "Added PC: " << curr_pc;
 
     // Iterate over callees.
-    while (cf_table[j]) {
+    while (j < cf_table.size() && cf_table[j]) {
       ++j;
     }
     ++j;  // Step over the delimiter.
-    FUZZTEST_CHECK_LE(j, cf_table.size());
+    FUZZTEST_CHECK_LE(j, cf_table.size()) << "Malformed CF table";
   }
   // Calculate cyclomatic complexity for all functions.
   for (PCIndex i = 0; i < pc_table.size(); ++i) {

centipede/control_flow_test.cc

@@ -98,6 +98,15 @@ TEST(CFTable, MakeCfgFromCfTable) {
   FUZZTEST_CHECK_EQ(cfg.GetCyclomaticComplexity(1), 2);
 }
 
+TEST(CFTableDeathTest, MakeCfgFromTruncatedCfTable) {
+  // The record for PC 1 is missing both of its delimiters, which is what a
+  // partially written cf-table file looks like.
+  static const CFTable truncated_cf_table = {1, 2, 3};
+  ControlFlowGraph cfg;
+  EXPECT_DEATH(cfg.InitializeControlFlowGraph(truncated_cf_table, g_pc_table),
+               "Malformed CF table");
+}
+
 TEST(CFTable, SerializesAndDeserializesCfTable) {
   std::stringstream stream;
   WriteCfTable(g_cf_table, stream);