[all-commits] [llvm/llvm-project] 8470df: [lldb] Guard DW_OP_convert against null DWARF unit...

[Yao Qi via All-commits]

  Branch: refs/heads/main
  Home:   https://github.com/llvm/llvm-project
  Commit: 8470dfb1e6190cc42c3eb151884533b8b4aba7e6
      https://github.com/llvm/llvm-project/commit/8470dfb1e6190cc42c3eb151884533b8b4aba7e6
  Author: Yao Qi <yao_qi at apple.com>
  Date:   2026-07-06 (Mon, 06 Jul 2026)

  Changed paths:
    M lldb/source/Expression/DWARFExpression.cpp
    M lldb/unittests/Expression/DWARFExpressionTest.cpp

  Log Message:
  -----------
  [lldb] Guard DW_OP_convert against null DWARF unit and empty stack (#207008)

`Evaluate_DW_OP_convert` dereferenced `eval_ctx.dwarf_cu` (the
`DWARFExpression` Delegate) whenever the operand DIE offset was
non-zero,
and unconditionally read `eval_ctx.stack.back()`.  When a DWARF
expression is evaluated without a DWARF unit (as the
lldb-dwarf-expression-fuzzer does), two operand shapes crash:

- `DW_OP_convert` with a non-zero offset calls
  `dwarf_cu->GetDIEBitSizeAndSign(...)` on a null Delegate.
- `DW_OP_convert` with nothing on the stack reads the back of an empty
  vector.

The unit test feeds both with `dwarf_cu == nullptr` and crashes:

```
[ RUN      ] DWARFExpression.DW_OP_convert
 #2 SignalHandler(int, __siginfo*, void*)
 #4 DWARFExpression::Evaluate(...)
 #5 Evaluate(ArrayRef<unsigned char>, ...)
```

(SIGSEGV, the process aborts.)

Bail out with an error when the stack is empty, and when a non-zero DIE
offset is requested without a DWARF unit, instead of crashing.

Extends `DWARFExpression.DW_OP_convert` with these two cases, which
crash
without the fix.

---------

Co-authored-by: Michael Buch <michaelbuch12 at gmail.com>



To unsubscribe from these emails, change your notification settings at https://github.com/llvm/llvm-project/settings/notifications