[Lldb-commits] [lldb] [lldb] Oversized DW_OP_piece triggers an unbounded allocation and aborts LLDB (PR #209397)

[Alexsander Borges Damaceno via lldb-commits]

https://github.com/AlexsanderDamaceno created https://github.com/llvm/llvm-project/pull/209397

A malformed DWARF expression can terminate LLDB by supplying an oversized byte-size operand to DW_OP_piece. LLDB does not validate the operand before using it to resize the piece buffer.

This patch adds a check before allocating heap memory for the value specified by DW_OP_piece.

Filled bug: https://github.com/llvm/llvm-project/issues/209166

>From a4654522de1ae5755333d4220b3e6e44bd0fe5fa Mon Sep 17 00:00:00 2001
From: AlexsanderDamaceno <aemgbo at gmail.com>
Date: Tue, 14 Jul 2026 04:53:48 -0300
Subject: [PATCH] E

---
 lldb/source/Expression/DWARFExpression.cpp | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/lldb/source/Expression/DWARFExpression.cpp b/lldb/source/Expression/DWARFExpression.cpp
index 364b2ecadadd4..592a3c0d58c86 100644
--- a/lldb/source/Expression/DWARFExpression.cpp
+++ b/lldb/source/Expression/DWARFExpression.cpp
@@ -1850,6 +1850,15 @@ llvm::Expected<Value> DWARFExpression::Evaluate(
 
       const uint64_t piece_byte_size = opcodes.GetULEB128(&offset);
 
+      // A single piece of a variable's location can never legitimately be
+      // this large. 
+      constexpr uint64_t kMaxDWARFPieceByteSize = 1024 * 1024 * 1024; // 1GB
+      if (piece_byte_size > kMaxDWARFPieceByteSize)
+        return llvm::createStringError(
+            "DW_OP_piece(%" PRIu64 ") is larger than the maximum allowed "
+            "size of %" PRIu64 " bytes",
+            piece_byte_size, kMaxDWARFPieceByteSize);
+
       if (piece_byte_size > 0) {
         Value curr_piece;