[all-commits] [llvm/llvm-project] f8a960: [lldb] Bound Mach-O symtab allocation to the file ...

[Yao Qi via All-commits]

  Branch: refs/heads/main
  Home:   https://github.com/llvm/llvm-project
  Commit: f8a96032096158c992ea4cd369e43068b2b072a7
      https://github.com/llvm/llvm-project/commit/f8a96032096158c992ea4cd369e43068b2b072a7
  Author: Yao Qi <yao_qi at apple.com>
  Date:   2026-09-13 (Sun, 13 Sep 2026)

  Changed paths:
    M lldb/source/Plugins/ObjectFile/Mach-O/ObjectFileMachO.cpp
    M lldb/unittests/ObjectFile/MachO/TestObjectFileMachO.cpp

  Log Message:
  -----------
  [lldb] Bound Mach-O symtab allocation to the file size (#222955)

Opening a Mach-O file whose LC_SYMTAB claims far more symbols than the
file could possibly hold makes lldb ask for hundreds of gigabytes.  A
128-byte file with LC_SYMTAB.nsyms = 0x80000000 (the new unit test's
input, built with yaml2obj) reproduces it through `lldb-target-fuzzer`,
the harness that found this bug:

```
==45515== ERROR: libFuzzer: out-of-memory (malloc(171798691840))
    #8  std::__1::__split_buffer<lldb_private::Symbol,...>::__split_buffer(...)
    #9  std::__1::vector<lldb_private::Symbol,...>::resize(unsigned long)
    #10 lldb_private::Symtab::Resize(unsigned long)
    #11 ObjectFileMachO::ParseSymtab(lldb_private::Symtab&)
```

`ParseSymtab()` sizes the destination `Symtab`'s `vector<Symbol>`
directly
from `nsyms` and `nindirectsyms`, two counts read from the file's
`LC_SYMTAB` and `LC_DYSYMTAB` commands.  `nlist_data`, the view already
built earlier in the function from the bytes the file actually has at
`symoff`, is far smaller than what those counts claim; the guard gating
this code only checks that it is non-empty, not how many nlist records
it can back.

Bound both counts by what `nlist_data` and `indirect_symbol_index_data`
(already clipped to the available bytes) can hold, instead of trusting
the file's counts outright.

Add a unit test whose LC_SYMTAB claims about two billion symbols in a
128-byte file; completing quickly instead of reserving that much space
is the regression check.

Assited-by: claude



To unsubscribe from these emails, change your notification settings at https://github.com/llvm/llvm-project/settings/notifications