[Lldb-commits] [lldb] [lldb][Mach-O] Bounds-check GetArchitectureAtIndex against m_fat_archs (PR #205289)

[Yao Qi via lldb-commits]

================
@@ -117,3 +119,29 @@ TEST_F(ObjectContainerUniversalMachOTest, SliceOffsetZero) {
 
   ASSERT_THAT_ERROR(TmpFile->discard(), llvm::Succeeded());
 }
+
+// Regression fixture: a universal (fat) Mach-O whose header claims a huge
+// nfat_arch (here 0xAFAFAFAF) but provides no fat_arch entries beyond the
+// header bytes.  Found by lldb-target-fuzzer.
+TEST_F(ObjectContainerUniversalMachOTest, NfatArchTruncatedSlices) {
+  // Hand-crafted fat header: FAT_MAGIC_64 + nfat_arch=0xAFAFAFAF + 2 stray
+  // payload bytes, not enough for even one fat_arch_64 entry (32 bytes).
+  const uint8_t kData[] = {
+      0xCA, 0xFE, 0xBA, 0xBF, // magic:     FAT_MAGIC_64 (big endian)
+      0xAF, 0xAF, 0xAF, 0xAF, // nfat_arch: 0xAFAFAFAF (untrusted, huge)
+      0xAF, 0xAF,             // truncated arch payload
+  };
+  lldb::DataBufferSP Buf =
+      std::make_shared<DataBufferHeap>(kData, sizeof(kData));
+
+  std::unique_ptr<lldb_private::ObjectContainer> Container(
+      ObjectContainerUniversalMachO::CreateInstance(
+          /*module_sp=*/nullptr, Buf, /*data_offset=*/0, /*file=*/nullptr,
+          /*file_offset=*/0, /*length=*/sizeof(kData)));
+  ASSERT_NE(Container.get(), nullptr);
+
+  // Before the fix, this m_fat_archs[0] causes an OOB std::vector access; after
+  // the fix the bounds check against m_fat_archs.size() returns false.
----------------
qiyao wrote:

I removed most of them, just keep one line to explain `EXPECT_FALSE` below.
```
// m_fat_archs has zero emlement, returns false
```

https://github.com/llvm/llvm-project/pull/205289