Skip to content

Commit ee47699

Browse files
committed
[LLDB] Fix buffer overflow problem in DWARFExpression::Evaluate.
In two calls to ReadMemory in DWARFExpression.cpp, the buffer size passed to ReadMemory is not actually the size of the buffer (I suspect a copy/paste error where the variable name was not properly updated). This caused a buffer overflow bug, which we found throuth Address Sanitizer. This patch fixes the problem by passing the correct buffer size to the calls to ReadMemory (and to the DataExtractor). Differential Revision: https://reviews.llvm.org/D153840
1 parent 015cd31 commit ee47699

File tree

1 file changed

+8
-7
lines changed

1 file changed

+8
-7
lines changed

lldb/source/Expression/DWARFExpression.cpp

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1138,15 +1138,16 @@ bool DWARFExpression::Evaluate(
11381138

11391139
if (load_addr == LLDB_INVALID_ADDRESS && so_addr.IsSectionOffset()) {
11401140
uint8_t addr_bytes[8];
1141+
size_t buf_size = sizeof(addr_bytes);
11411142
Status error;
11421143

11431144
if (target &&
1144-
target->ReadMemory(so_addr, &addr_bytes, size, error,
1145-
/*force_live_memory=*/false) == size) {
1145+
target->ReadMemory(so_addr, &addr_bytes, buf_size, error,
1146+
/*force_live_memory=*/false) == buf_size) {
11461147
ObjectFile *objfile = module_sp->GetObjectFile();
11471148

11481149
stack.back().GetScalar() = DerefSizeExtractDataHelper(
1149-
addr_bytes, size, objfile->GetByteOrder(), size);
1150+
addr_bytes, size, objfile->GetByteOrder(), buf_size);
11501151
stack.back().ClearContext();
11511152
break;
11521153
} else {
@@ -1170,13 +1171,13 @@ bool DWARFExpression::Evaluate(
11701171
lldb::addr_t pointer_addr =
11711172
stack.back().GetScalar().ULongLong(LLDB_INVALID_ADDRESS);
11721173
uint8_t addr_bytes[sizeof(lldb::addr_t)];
1174+
size_t buf_size = sizeof(addr_bytes);
11731175
Status error;
1174-
if (process->ReadMemory(pointer_addr, &addr_bytes, size, error) ==
1175-
size) {
1176-
1176+
if (process->ReadMemory(pointer_addr, &addr_bytes, buf_size, error)
1177+
== buf_size) {
11771178
stack.back().GetScalar() =
11781179
DerefSizeExtractDataHelper(addr_bytes, sizeof(addr_bytes),
1179-
process->GetByteOrder(), size);
1180+
process->GetByteOrder(), buf_size);
11801181
stack.back().ClearContext();
11811182
} else {
11821183
if (error_ptr)

0 commit comments

Comments
 (0)