This is an archive of the discontinued LLVM Phabricator instance.

[lldb/plugin] Fix heap-use-after-free in ScriptedProcess::ReadMemory
ClosedPublic

Authored by mib on Dec 13 2021, 10:55 AM.

Details

Summary

This commit should fix a heap-use-after-free bug that was caught by the
sanitizer bot.

The issue is that we were reading memory from a second target into a
SBData object in Python, that was passed to lldb's internal
ScriptedProcess::DoReadMemory C++ method.

The ScriptedPythonInterface then extracts the underlying DataExtractor
from the SBData object, and is used to read the memory with the
appropriate address size and byte order.

Unfortunately, it seems that even though the DataExtractor object was
still valid, it pointed to invalid, possibly garbage-collected memory
from Python.

To mitigate this, the patch uses SBData::SetDataWithOwnership to copy
the pointed buffer to lldb's heap memory which prevents the
use-after-free error.

rdar://84511405

Signed-off-by: Med Ismail Bennani <medismail.bennani@gmail.com>

Diff Detail