[all-commits] [llvm/llvm-project] 6b4262: [lldb] Reject DW_OP_deref_size with size 0 (#205911)

[Yao Qi via All-commits]

  Branch: refs/heads/main
  Home:   https://github.com/llvm/llvm-project
  Commit: 6b42621d92b0ae1322a93ff288979cb09774ebbf
      https://github.com/llvm/llvm-project/commit/6b42621d92b0ae1322a93ff288979cb09774ebbf
  Author: Yao Qi <yao_qi at apple.com>
  Date:   2026-06-25 (Thu, 25 Jun 2026)

  Changed paths:
    M lldb/source/Expression/DWARFExpression.cpp
    M lldb/unittests/Expression/DWARFExpressionTest.cpp

  Log Message:
  -----------
  [lldb] Reject DW_OP_deref_size with size 0 (#205911)

`Evaluate_DW_OP_deref` validated that the dereference size was `<= 8`
but
not that it was non-zero.  The DWARF expression evaluator parses
untrusted operands, so a `DW_OP_deref_size` with size operand `0` is
reachable (it is hit by the lldb-dwarf-expression-fuzzer).

A zero dereference size flows into `DerefSizeExtractDataHelper`, which
constructs a `DataExtractor` with `addr_size == 0` and aborts on its
assertion. The unit test that feeds `DW_OP_lit0, DW_OP_deref_size, 0x00`
shows the crash:

```
[ RUN      ] DWARFExpressionMockProcessTest.DW_OP_deref_size_zero
Assertion failed: (addr_size >= 1 && addr_size <= 8), function
DataExtractor, file DataExtractor.cpp, line 134.
 #8  DataExtractor::DataExtractor(...)
 #11 DWARFExpression::Evaluate(...)
```

Reject a zero dereference size with an error, alongside the existing
`size > 8` check.

Adds `DWARFExpressionMockProcessTest.DW_OP_deref_size_zero`, which
aborts on the assertion above without the fix.



To unsubscribe from these emails, change your notification settings at https://github.com/llvm/llvm-project/settings/notifications