llvmorg-github-actions[bot] wrote:
<!--LLVM PR SUMMARY COMMENT--> @llvm/pr-subscribers-lldb Author: Alexsander Borges Damaceno (AlexsanderDamaceno) <details> <summary>Changes</summary> A malformed DWARF expression can terminate LLDB by supplying an oversized byte-size operand to DW_OP_piece. LLDB does not validate the operand before using it to resize the piece buffer. This patch adds a check before allocating heap memory for the value specified by DW_OP_piece. Filled bug: https://github.com/llvm/llvm-project/issues/209166 --- Full diff: https://github.com/llvm/llvm-project/pull/209397.diff 1 Files Affected: - (modified) lldb/source/Expression/DWARFExpression.cpp (+9) ``````````diff diff --git a/lldb/source/Expression/DWARFExpression.cpp b/lldb/source/Expression/DWARFExpression.cpp index 364b2ecadadd4..592a3c0d58c86 100644 --- a/lldb/source/Expression/DWARFExpression.cpp +++ b/lldb/source/Expression/DWARFExpression.cpp @@ -1850,6 +1850,15 @@ llvm::Expected<Value> DWARFExpression::Evaluate( const uint64_t piece_byte_size = opcodes.GetULEB128(&offset); + // A single piece of a variable's location can never legitimately be + // this large. + constexpr uint64_t kMaxDWARFPieceByteSize = 1024 * 1024 * 1024; // 1GB + if (piece_byte_size > kMaxDWARFPieceByteSize) + return llvm::createStringError( + "DW_OP_piece(%" PRIu64 ") is larger than the maximum allowed " + "size of %" PRIu64 " bytes", + piece_byte_size, kMaxDWARFPieceByteSize); + if (piece_byte_size > 0) { Value curr_piece; `````````` </details> https://github.com/llvm/llvm-project/pull/209397 _______________________________________________ lldb-commits mailing list [email protected] https://lists.llvm.org/cgi-bin/mailman/listinfo/lldb-commits
