[Lldb-commits] [lldb] [lldb] Oversized DW_OP_piece triggers an unbounded allocation and aborts LLDB (PR #209397)

[via lldb-commits]

llvmorg-github-actions[bot] wrote:


<!--LLVM PR SUMMARY COMMENT-->

@llvm/pr-subscribers-lldb

Author: Alexsander Borges Damaceno (AlexsanderDamaceno)

<details>
<summary>Changes</summary>

A malformed DWARF expression can terminate LLDB by supplying an oversized byte-size operand to DW_OP_piece. LLDB does not validate the operand before using it to resize the piece buffer.

This patch adds a check before allocating heap memory for the value specified by DW_OP_piece.

Filled bug: https://github.com/llvm/llvm-project/issues/209166

---
Full diff: https://github.com/llvm/llvm-project/pull/209397.diff


1 Files Affected:

- (modified) lldb/source/Expression/DWARFExpression.cpp (+9) 


``````````diff
diff --git a/lldb/source/Expression/DWARFExpression.cpp b/lldb/source/Expression/DWARFExpression.cpp
index 364b2ecadadd4..592a3c0d58c86 100644
--- a/lldb/source/Expression/DWARFExpression.cpp
+++ b/lldb/source/Expression/DWARFExpression.cpp
@@ -1850,6 +1850,15 @@ llvm::Expected<Value> DWARFExpression::Evaluate(
 
       const uint64_t piece_byte_size = opcodes.GetULEB128(&offset);
 
+      // A single piece of a variable's location can never legitimately be
+      // this large. 
+      constexpr uint64_t kMaxDWARFPieceByteSize = 1024 * 1024 * 1024; // 1GB
+      if (piece_byte_size > kMaxDWARFPieceByteSize)
+        return llvm::createStringError(
+            "DW_OP_piece(%" PRIu64 ") is larger than the maximum allowed "
+            "size of %" PRIu64 " bytes",
+            piece_byte_size, kMaxDWARFPieceByteSize);
+
       if (piece_byte_size > 0) {
         Value curr_piece;
 

``````````

</details>


https://github.com/llvm/llvm-project/pull/209397