================
@@ -117,3 +119,29 @@ TEST_F(ObjectContainerUniversalMachOTest, SliceOffsetZero)
{
ASSERT_THAT_ERROR(TmpFile->discard(), llvm::Succeeded());
}
+
+// Regression fixture: a universal (fat) Mach-O whose header claims a huge
+// nfat_arch (here 0xAFAFAFAF) but provides no fat_arch entries beyond the
+// header bytes. Found by lldb-target-fuzzer.
+TEST_F(ObjectContainerUniversalMachOTest, NfatArchTruncatedSlices) {
+ // Hand-crafted fat header: FAT_MAGIC_64 + nfat_arch=0xAFAFAFAF + 2 stray
+ // payload bytes, not enough for even one fat_arch_64 entry (32 bytes).
+ const uint8_t kData[] = {
+ 0xCA, 0xFE, 0xBA, 0xBF, // magic: FAT_MAGIC_64 (big endian)
+ 0xAF, 0xAF, 0xAF, 0xAF, // nfat_arch: 0xAFAFAFAF (untrusted, huge)
+ 0xAF, 0xAF, // truncated arch payload
+ };
+ lldb::DataBufferSP Buf =
+ std::make_shared<DataBufferHeap>(kData, sizeof(kData));
+
+ std::unique_ptr<lldb_private::ObjectContainer> Container(
+ ObjectContainerUniversalMachO::CreateInstance(
+ /*module_sp=*/nullptr, Buf, /*data_offset=*/0, /*file=*/nullptr,
+ /*file_offset=*/0, /*length=*/sizeof(kData)));
+ ASSERT_NE(Container.get(), nullptr);
+
+ // Before the fix, this m_fat_archs[0] causes an OOB std::vector access;
after
+ // the fix the bounds check against m_fat_archs.size() returns false.
----------------
qiyao wrote:
I removed most of them, just keep one line to explain `EXPECT_FALSE` below.
```
// m_fat_archs has zero emlement, returns false
```
https://github.com/llvm/llvm-project/pull/205289
_______________________________________________
lldb-commits mailing list
[email protected]
https://lists.llvm.org/cgi-bin/mailman/listinfo/lldb-commits
