[all-commits] [llvm/llvm-project] 8a85fe: [lldb] Fix heap-use-after-free in scripted process...

[Med Ismail Bennani via All-commits]

  Branch: refs/heads/main
  Home:   https://github.com/llvm/llvm-project
  Commit: 8a85fe173645e065bddf16b885ddfd85cbc28883
      https://github.com/llvm/llvm-project/commit/8a85fe173645e065bddf16b885ddfd85cbc28883
  Author: Med Ismail Bennani <ismail at bennani.ma>
  Date:   2026-09-22 (Tue, 22 Sep 2026)

  Changed paths:
    M lldb/source/API/SBData.cpp
    M lldb/test/API/functionalities/scripted_process/addressable_bits_scripted_process.py

  Log Message:
  -----------
  [lldb] Fix heap-use-after-free in scripted process memory reads (#225472)

The ASan bots hit a use-after-free unwinding the scripted process in
TestScriptedProcess:

```
  READ of size 512
    #1 DataExtractor::CopyByteOrderedData() DataExtractor.cpp:660
    #2 ScriptedProcess::DoReadMemory() ScriptedProcess.cpp:282
    #3 Process::ReadMemoryFromInferior() Process.cpp:2453
    #4 MemoryCache::Read() Memory.cpp:323
 ```

AddressableBitsScriptedProcess.read_memory_at_address(), added in 851eb5a97ba6, filled its SBData with SetData(). That overload is non-owning: it builds a DataExtractor that aliases the caller's buffer. The buffer it was handed is a `bytes(size)` temporary, which Python frees as soon as the call returns, so DoReadMemory copies out of a dead allocation. The 512 is the default
target.memory-cache-line-size, not the register width the unwinder asked for.

Use SetDataWithOwnership() instead, as every other scripted process script already does.

Signed-off-by: Med Ismail Bennani <ismail at bennani.ma>



To unsubscribe from these emails, change your notification settings at https://github.com/llvm/llvm-project/settings/notifications