This is an archive of the discontinued LLVM Phabricator instance.

[PDB] Fix use after free.
ClosedPublic

Authored by zturner on Jun 2 2017, 5:22 PM.

Details

Summary

Previously MappedBlockStream owned its own BumpPtrAllocator that
it would allocate from when a read crossed a block boundary. This
way it could still return the user a contiguous buffer of the
requested size. However, It's not uncommon to open a stream, read
some stuff, close it, and then save the information for later.
After all, since the entire file is mapped into memory, the data
should always be available as long as the file is open.

Of course, the exception to this is when the data isn't *in* the
file, but rather in some buffer that we temporarily allocated to
present this contiguous view. And this buffer would get destroyed
as soon as the strema was closed.

The fix here is to force the user to specify the allocator, this
way it can provide an allocator that has whatever lifetime it
chooses.

Diff Detail

Repository
rL LLVM

Event Timeline

zturner created this revision.Jun 2 2017, 5:22 PM

Also, no current code was exercising this bug which is why it never surfaced on ASAN bots. It's difficult to generate a PDB that is guaranteed to exhibit this problem, so instead a unit test is used. The unit test arranges the blocks of a fabricated MappedBlockStream so that it's guaranteed to allocate from the temporary allocator, and then it ensures that this data lives after the stream is destroyed.

inglorion accepted this revision.Jun 2 2017, 5:26 PM

lgtm. Thanks!

This revision is now accepted and ready to land.Jun 2 2017, 5:26 PM
This revision was automatically updated to reflect the committed changes.