[Lldb-commits] [lldb] e5c9691 - [lldb] Fix OOB write in MultiMemRead response parsing (#226168)

[via lldb-commits]

Author: Felipe de Azevedo Piovezan
Date: 2026-09-24T16:51:55+01:00
New Revision: e5c969157449c62ac255389dfad4847b213a4773

URL: https://github.com/llvm/llvm-project/commit/e5c969157449c62ac255389dfad4847b213a4773
DIFF: https://github.com/llvm/llvm-project/commit/e5c969157449c62ac255389dfad4847b213a4773.diff

LOG: [lldb] Fix OOB write in MultiMemRead response parsing (#226168)

Change some memory writes in ParseMultiMemReadPacket so that it no
longer asserts on OOB accesses, instead returning an error. This makes
the code correct even in release builds.

Added: 
    

Modified: 
    lldb/source/Plugins/Process/gdb-remote/ProcessGDBRemote.cpp

Removed: 
    


################################################################################
diff  --git a/lldb/source/Plugins/Process/gdb-remote/ProcessGDBRemote.cpp b/lldb/source/Plugins/Process/gdb-remote/ProcessGDBRemote.cpp
index 33d34fe644216..151932b67dca9 100644
--- a/lldb/source/Plugins/Process/gdb-remote/ProcessGDBRemote.cpp
+++ b/lldb/source/Plugins/Process/gdb-remote/ProcessGDBRemote.cpp
@@ -3129,6 +3129,7 @@ llvm::Error ProcessGDBRemote::ParseMultiMemReadPacket(
         response_str);
 
   // Sizes are separated by a `,`.
+  unsigned num_sizes = 0;
   for (llvm::StringRef size_str : llvm::split(sizes_str, ',')) {
     uint64_t read_size;
     if (size_str.getAsInteger(BASE_16, read_size))
@@ -3140,18 +3141,28 @@ llvm::Error ProcessGDBRemote::ParseMultiMemReadPacket(
                                       "enough data, requested sizes: {0}",
                                       sizes_str);
 
+    if (read_size > buffer.size())
+      return llvm::createStringErrorV(
+          "MultiMemRead response size {0} exceeds remaining buffer {1}",
+          read_size, buffer.size());
+
     llvm::StringRef region_to_read = memory_data.take_front(read_size);
     memory_data = memory_data.drop_front(read_size);
 
-    assert(buffer.size() >= read_size);
     llvm::MutableArrayRef<uint8_t> region_to_write =
         buffer.take_front(read_size);
     buffer = buffer.drop_front(read_size);
 
     memcpy(region_to_write.data(), region_to_read.data(), read_size);
     memory_regions.push_back(region_to_write);
+    ++num_sizes;
   }
 
+  if (num_sizes != expected_num_ranges)
+    return llvm::createStringErrorV(
+        "MultiMemRead response had {0} sizes, expected {1}", num_sizes,
+        expected_num_ranges);
+
   return llvm::Error::success();
 }