[all-commits] [llvm/llvm-project] 55c61f: [Remarks] Fix use-after-free of block scalar value...

[Henrich Lauko via All-commits]

  Branch: refs/heads/users/xlauko/yaml-remark-block-uaf
  Home:   https://github.com/llvm/llvm-project
  Commit: 55c61f6544b20097999f6aba885fff4a44c743f4
      https://github.com/llvm/llvm-project/commit/55c61f6544b20097999f6aba885fff4a44c743f4
  Author: Henrich Lauko <hlauko at nvidia.com>
  Date:   2026-10-01 (Thu, 01 Oct 2026)

  Changed paths:
    M llvm/lib/Remarks/YAMLRemarkParser.cpp
    M llvm/lib/Remarks/YAMLRemarkParser.h
    M llvm/unittests/Remarks/YAMLRemarksParsingTest.cpp

  Log Message:
  -----------
  [Remarks] Fix use-after-free of block scalar values in the YAML remark parser

YAMLRemarkParser::parseStr returned BlockScalarNode::getValue() as is.
The YAML parser copies a block scalar's value into the document's node
allocator, and next() advances the document iterator before returning
the remark, which frees that allocator. So every argument value written
as a block scalar pointed at freed memory by the time the caller saw
it.

Copy block scalar values into an allocator owned by the parser.

Assisted-by: Claude



To unsubscribe from these emails, change your notification settings at https://github.com/llvm/llvm-project/settings/notifications