Skip to content

Commit cf38a27

Browse files
committed
[lldb/plugin] Fix heap-use-after-free in ScriptedProcess::ReadMemory
This commit should fix a heap-use-after-free bug that was caught by the sanitizer bot. The issue is that we were reading memory from a second target into a `SBData` object in Python, that was passed to lldb's internal `ScriptedProcess::DoReadMemory` C++ method. The ScriptedPythonInterface then extracts the underlying `DataExtractor` from the `SBData` object, and is used to read the memory with the appropriate address size and byte order. Unfortunately, it seems that even though the DataExtractor object was still valid, it pointed to invalid, possibly garbage-collected memory from Python. To mitigate this, the patch uses `SBData::SetDataWithOwnership` to copy the pointed buffer to lldb's heap memory which prevents the use-after-free error. rdar://84511405 Differential Revision: https://reviews.llvm.org/D115654 Signed-off-by: Med Ismail Bennani <[email protected]>
1 parent 85c7ed7 commit cf38a27

File tree

2 files changed

+3
-3
lines changed

2 files changed

+3
-3
lines changed

lldb/test/API/functionalities/scripted_process/TestScriptedProcess.py

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -139,7 +139,6 @@ def create_stack_skinny_corefile(self, file):
139139

140140
@skipUnlessDarwin
141141
@skipIfOutOfTreeDebugserver
142-
@skipIfAsan # rdar://85954489
143142
def test_launch_scripted_process_stack_frames(self):
144143
"""Test that we can launch an lldb scripted process from the command
145144
line, check its process ID and read string from memory."""

lldb/test/API/functionalities/scripted_process/stack_core_scripted_process.py

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -43,8 +43,9 @@ def read_memory_at_address(self, addr: int, size: int) -> lldb.SBData:
4343
if error.Fail():
4444
return data
4545

46-
data.SetData(error, bytes_read, self.corefile_target.GetByteOrder(),
47-
self.corefile_target.GetAddressByteSize())
46+
data.SetDataWithOwnership(error, bytes_read,
47+
self.corefile_target.GetByteOrder(),
48+
self.corefile_target.GetAddressByteSize())
4849

4950
return data
5051

0 commit comments

Comments
 (0)