https://github.com/AlexsanderDamaceno created https://github.com/llvm/llvm-project/pull/209397
A malformed DWARF expression can terminate LLDB by supplying an oversized byte-size operand to DW_OP_piece. LLDB does not validate the operand before using it to resize the piece buffer. This patch adds a check before allocating heap memory for the value specified by DW_OP_piece. Filled bug: https://github.com/llvm/llvm-project/issues/209166 >From a4654522de1ae5755333d4220b3e6e44bd0fe5fa Mon Sep 17 00:00:00 2001 From: AlexsanderDamaceno <[email protected]> Date: Tue, 14 Jul 2026 04:53:48 -0300 Subject: [PATCH] E --- lldb/source/Expression/DWARFExpression.cpp | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/lldb/source/Expression/DWARFExpression.cpp b/lldb/source/Expression/DWARFExpression.cpp index 364b2ecadadd4..592a3c0d58c86 100644 --- a/lldb/source/Expression/DWARFExpression.cpp +++ b/lldb/source/Expression/DWARFExpression.cpp @@ -1850,6 +1850,15 @@ llvm::Expected<Value> DWARFExpression::Evaluate( const uint64_t piece_byte_size = opcodes.GetULEB128(&offset); + // A single piece of a variable's location can never legitimately be + // this large. + constexpr uint64_t kMaxDWARFPieceByteSize = 1024 * 1024 * 1024; // 1GB + if (piece_byte_size > kMaxDWARFPieceByteSize) + return llvm::createStringError( + "DW_OP_piece(%" PRIu64 ") is larger than the maximum allowed " + "size of %" PRIu64 " bytes", + piece_byte_size, kMaxDWARFPieceByteSize); + if (piece_byte_size > 0) { Value curr_piece; _______________________________________________ lldb-commits mailing list [email protected] https://lists.llvm.org/cgi-bin/mailman/listinfo/lldb-commits
