[all-commits] [llvm/llvm-project] d7f2a9: [lldb] Validate universal Mach-O slice bounds befo...

[Yao Qi via All-commits]

  Branch: refs/heads/main
  Home:   https://github.com/llvm/llvm-project
  Commit: d7f2a9df46058dedfa97d35ba6596a01f8ecebe3
      https://github.com/llvm/llvm-project/commit/d7f2a9df46058dedfa97d35ba6596a01f8ecebe3
  Author: Yao Qi <yao_qi at apple.com>
  Date:   2026-09-11 (Fri, 11 Sep 2026)

  Changed paths:
    M lldb/source/Plugins/ObjectContainer/Universal-Mach-O/ObjectContainerUniversalMachO.cpp
    M lldb/unittests/ObjectContainer/CMakeLists.txt
    M lldb/unittests/ObjectContainer/ObjectContainerUniversalMachOTest.cpp

  Log Message:
  -----------
  [lldb] Validate universal Mach-O slice bounds before parsing (#221493)

Opening a corrupt universal (fat) Mach-O file can crash lldb. A fat-arch
header entry's (offset, size) pair is untrusted, and `GetObjectFile()`
passes it straight to `ObjectFile::FindPlugin()` with no check against
the
container's own size.

A slice whose offset is 0 points back at the start of the same fat
header,
so `GetObjectFile()` recurses into itself until the stack is exhausted:

```
$ ./ObjectContainerTests --gtest_filter=GetObjectFileSelfReferentialSlice
    #230 ObjectContainerUniversalMachO::GetObjectFile(FileSpec const*) ObjectContainerUniversalMachO.cpp:188
    #231 CreateObjectFromContainer(...) ObjectFile.cpp:43
    #232 lldb_private::ObjectFile::FindPlugin(...) ObjectFile.cpp:146
    #233 ObjectContainerUniversalMachO::GetObjectFile(FileSpec const*) ObjectContainerUniversalMachO.cpp:188
    (repeats until the stack is exhausted)
SUMMARY: AddressSanitizer: stack-overflow (libsystem_trace.dylib:arm64e+0x16bd8) in os_log_fmt_flatten+0x6d4
```
A slice whose declared size is far larger than the file reaches the
allocator instead, with the untrusted size unchanged:

```
$ ./ObjectContainerTests --gtest_filter=GetObjectFileOversizedSlice
==89958==ERROR: AddressSanitizer: requested allocation size 0xffffffffffff0046
(0xffffffffffff1048 after adjustments for alignment, red zones etc.) exceeds
maximum supported size of 0x10000000000 (thread T0)
    #9 ObjectContainerUniversalMachO::GetObjectFile(FileSpec const*) ObjectContainerUniversalMachO.cpp:188
SUMMARY: AddressSanitizer: allocation-size-too-big MemoryBuffer.cpp:343 in
llvm::WritableMemoryBuffer::getNewUninitMemBuffer(unsigned long, llvm::Twine const&, std::__1::optional<llvm::Align>)
```

`GetModuleSpecifications()` in the same file already guards its own
recursion this way: it only follows a slice that starts strictly past
the
container's current offset, and clamps the recursive call to the bytes
remaining in the container.  Apply the same check to `GetObjectFile()`.

Found with lldb-target-fuzzer. The commands above are the two regression
tests added here.



To unsubscribe from these emails, change your notification settings at https://github.com/llvm/llvm-project/settings/notifications