Null pointer dereference in AArch64AsmParser::tryParseAdjImm0_63 via unchecked dyn_cast

Compiler explorer: https://godbolt.org/z/9o6sqo8rW

Vulnerable code location(s)

llvm/lib/Target/AArch64/AsmParser/AArch64AsmParser.cpp, line 8937

Vulnerable code analysis

tryParseAdjImm0_63 checks that the current token is AsmToken::Integer, then calls parseExpression(Ex). The result is cast via dyn_cast<MCConstantExpr>(Ex)->getValue() without a null check.

Although the first token is an integer, parseExpression can consume additional tokens and return a non-MCConstantExpr. For example, input 1f is parsed as a forward directional label reference (MCSymbolRefExpr), and 1 + sym produces an MCBinaryExpr. In either case, dyn_cast returns nullptr, which is immediately dereferenced.

int64_t Imm = dyn_cast<MCConstantExpr>(Ex)->getValue(); // nullptr dereference

The POC uses the cbge instruction (which invokes tryParseAdjImm0_63) with operand 1f, causing parseExpression to return an MCSymbolRefExpr and triggering the crash.

PoC

cbge w0, 1f, .target