llvm / llvm/llvm-project

[lldb] Oversized DW_OP_piece triggers an unbounded allocation and aborts LLDB

Open
#209,166 1 comment 0 reactions 0 assignees View on GitHub
lldb
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

A malformed DWARF expression can terminate LLDB by supplying an oversized byte-size operand to `DW_OP_piece`. LLDB does not validate the operand before using it to resize the piece buffer, so `DW_OP_piece 0x2000000000000000` can trigger a `2^61`-byte (2 EiB) allocation attempt and reach LLVM's fatal out-of-memory handler.

Malformed debug information should produce a normal expression-evaluation error, not abort the debugger process.

## Minimal Case

```text
DW_OP_lit0
DW_OP_piece 0x2000000000000000
```

Instead of rejecting the oversized piece, LLDB terminates with:

```text
LLVM ERROR: out of memory
Allocation failed
```

Contributor guide

Open the contributing guide

Research direction

Start in LLDB's DW_OP_piece expression-evaluation path and reproduce the minimal DWARF expression shown in the issue. Done means the oversized operand is rejected with a normal expression-evaluation error rather than triggering an unbounded allocation or abort; the payload names no source file or test.

Written by the indexing model from the issue text.

Assessment

Domain
devtools
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
56/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.