[all-commits] [llvm/llvm-project] 655859: [LLD][COFF] Fix out-of-bounds write when filling g...

[Petr Beneš via All-commits]

  Branch: refs/heads/main
  Home:   https://github.com/llvm/llvm-project
  Commit: 6558595ca3ac531270a6691c758b835ee8adfdd5
      https://github.com/llvm/llvm-project/commit/6558595ca3ac531270a6691c758b835ee8adfdd5
  Author: Petr Beneš <w.benny at outlook.com>
  Date:   2026-02-10 (Tue, 10 Feb 2026)

  Changed paths:
    M lld/COFF/Writer.cpp
    A lld/test/COFF/merge-bss-text-filealign1.test

  Log Message:
  -----------
  [LLD][COFF] Fix out-of-bounds write when filling gaps with INT3 in code sections (#180411)

When merging `.bss` into a code section (e.g., `/MERGE:.bss=.text`), the
INT3 gap-filling loop in `writeSections()` would write past the output
buffer. This happens because `.bss` chunks have `hasData=false`, so they
contribute to `VirtualSize` but not `SizeOfRawData`. The loop was using
chunk RVAs without checking if they exceeded the raw data region.

This caused a crash on Windows with `/FILEALIGN:1` (access violation
0xC0000005). The tight alignment leaves no slack in the mapped buffer,
so the overflow immediately hits unmapped memory.

The fix bounds all memset operations to `rawSize` and exits early when
encountering chunks beyond the raw data boundary.

Fixes #180406



To unsubscribe from these emails, change your notification settings at https://github.com/llvm/llvm-project/settings/notifications