[lldb] Oversized DW_OP_piece triggers an unbounded allocation and aborts LLDB
- Dominant language
- LLVM
- Stars
- 40.5k
- Forks
- 18.7k
- PR merge metrics
- PR metrics pending
Description
A malformed DWARF expression can terminate LLDB by supplying an oversized byte-size operand to `DW_OP_piece`. LLDB does not validate the operand before using it to resize the piece buffer, so `DW_OP_piece 0x2000000000000000` can trigger a `2^61`-byte (2 EiB) allocation attempt and reach LLVM's fatal out-of-memory handler.
Malformed debug information should produce a normal expression-evaluation error, not abort the debugger process.
## Minimal Case
```text
DW_OP_lit0
DW_OP_piece 0x2000000000000000
```
Instead of rejecting the oversized piece, LLDB terminates with:
```text
LLVM ERROR: out of memory
Allocation failed
```
Contributor guide
Research direction
Start in LLDB's DW_OP_piece expression-evaluation path and reproduce the minimal DWARF expression shown in the issue. Done means the oversized operand is rejected with a normal expression-evaluation error rather than triggering an unbounded allocation or abort; the payload names no source file or test.
Written by the indexing model from the issue text.
Assessment
- Domain
- devtools
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 56/100