[Lldb-commits] [lldb] [lldb] Fix OOB write in MultiMemRead response parsing (PR #226168)

[Felipe de Azevedo Piovezan via lldb-commits]

https://github.com/felipepiovezan created https://github.com/llvm/llvm-project/pull/226168

Change some memory writes in ParseMultiMemReadPacket so that it no longer asserts on OOB accesses, instead returning an error. This makes the code correct even in release builds.

>From 39a6c4917319087b4f9af37a0f3a5221776d216a Mon Sep 17 00:00:00 2001
From: Felipe de Azevedo Piovezan <fpiovezan at apple.com>
Date: Thu, 24 Sep 2026 10:39:46 +0100
Subject: [PATCH] [lldb] Fix OOB write in MultiMemRead response parsing

Change some memory writes in ParseMultiMemReadPacket so that it no
longer asserts on OOB accesses, instead returning an error. This makes
the code correct even in release builds.
---
 .../Plugins/Process/gdb-remote/ProcessGDBRemote.cpp | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/lldb/source/Plugins/Process/gdb-remote/ProcessGDBRemote.cpp b/lldb/source/Plugins/Process/gdb-remote/ProcessGDBRemote.cpp
index 33d34fe644216..151932b67dca9 100644
--- a/lldb/source/Plugins/Process/gdb-remote/ProcessGDBRemote.cpp
+++ b/lldb/source/Plugins/Process/gdb-remote/ProcessGDBRemote.cpp
@@ -3129,6 +3129,7 @@ llvm::Error ProcessGDBRemote::ParseMultiMemReadPacket(
         response_str);
 
   // Sizes are separated by a `,`.
+  unsigned num_sizes = 0;
   for (llvm::StringRef size_str : llvm::split(sizes_str, ',')) {
     uint64_t read_size;
     if (size_str.getAsInteger(BASE_16, read_size))
@@ -3140,18 +3141,28 @@ llvm::Error ProcessGDBRemote::ParseMultiMemReadPacket(
                                       "enough data, requested sizes: {0}",
                                       sizes_str);
 
+    if (read_size > buffer.size())
+      return llvm::createStringErrorV(
+          "MultiMemRead response size {0} exceeds remaining buffer {1}",
+          read_size, buffer.size());
+
     llvm::StringRef region_to_read = memory_data.take_front(read_size);
     memory_data = memory_data.drop_front(read_size);
 
-    assert(buffer.size() >= read_size);
     llvm::MutableArrayRef<uint8_t> region_to_write =
         buffer.take_front(read_size);
     buffer = buffer.drop_front(read_size);
 
     memcpy(region_to_write.data(), region_to_read.data(), read_size);
     memory_regions.push_back(region_to_write);
+    ++num_sizes;
   }
 
+  if (num_sizes != expected_num_ranges)
+    return llvm::createStringErrorV(
+        "MultiMemRead response had {0} sizes, expected {1}", num_sizes,
+        expected_num_ranges);
+
   return llvm::Error::success();
 }