[Lldb-commits] [lldb] [lldb] Oversized DW_OP_piece triggers an unbounded allocation and aborts LLDB (PR #209397)

[via lldb-commits]

================
@@ -1107,6 +1107,15 @@ static llvm::Error Evaluate_DW_OP_piece(EvalContext &eval_ctx,
   if (piece_byte_size == 0)
     return llvm::Error::success();
 
+  // A single piece of a variable's location can never legitimately be
+  // this large.
+  constexpr uint64_t kMaxDWARFPieceByteSize = 1024 * 1024 * 1024; // 1GB
----------------
firmiana402 wrote:

Could we apply this limit to the total assembled result rather than to each piece individually? An expression can contain many pieces that each pass this check, while `eval_ctx.pieces` continues to grow.

We could compute `eval_ctx.op_piece_offset + piece_byte_size` and reject totals that exceed the maximum allowed result size. This would cover both oversized single pieces and cumulative allocation growth.

https://github.com/llvm/llvm-project/pull/209397