Author: Yao Qi Date: 2026-07-27T16:20:24+01:00 New Revision: 6baa9c9ac22c60e00471c6412387b5a48aa12e3e
URL: https://github.com/llvm/llvm-project/commit/6baa9c9ac22c60e00471c6412387b5a48aa12e3e DIFF: https://github.com/llvm/llvm-project/commit/6baa9c9ac22c60e00471c6412387b5a48aa12e3e.diff LOG: [lldb][Mach-O] Fix null __LINKEDIT deref in ParseSymtab for shared cache images (#207448) `ObjectFileMachO::ParseSymtab`, when handling a local shared cache image (`MH_DYLIB_IN_CACHE` set and not read from memory), unconditionally called `linkedit_section_sp->GetFileOffset()` to slide the load command offsets. If the Mach-O has no `__LINKEDIT` segment, `FindSectionByName` returns a `null` SectionSP, and this is a member call on a null pointer (caught by UBSan; crashes in release builds). ``` * thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x68) * frame #0: 0x0000000100121ff0 ObjectFileMachOTests`lldb_private::Section::GetFileOffset(this=0x0000000000000000) const at Section.h:181:49 [opt] [inlined] frame #1: 0x0000000100121ff0 ObjectFileMachOTests`ObjectFileMachO::ParseSymtab(this=0x00000001055616b0, symtab= 0x000000016fdfe988) at ObjectFileMachO.cpp:2353:59 [opt] ``` Guard the shared-cache slide branch with a null check on `linkedit_section_sp`, matching the existing guard used on the in-memory path. Found by lldb-target-fuzzer. --------- Co-authored-by: Jonas Devlieghere <[email protected]> Added: Modified: lldb/source/Plugins/ObjectFile/Mach-O/ObjectFileMachO.cpp lldb/unittests/ObjectFile/MachO/TestObjectFileMachO.cpp Removed: ################################################################################ diff --git a/lldb/source/Plugins/ObjectFile/Mach-O/ObjectFileMachO.cpp b/lldb/source/Plugins/ObjectFile/Mach-O/ObjectFileMachO.cpp index bfe88256adc67..9eab45f57f422 100644 --- a/lldb/source/Plugins/ObjectFile/Mach-O/ObjectFileMachO.cpp +++ b/lldb/source/Plugins/ObjectFile/Mach-O/ObjectFileMachO.cpp @@ -2338,7 +2338,7 @@ void ObjectFileMachO::ParseSymtab(Symtab &symtab) { } } } else { - if (is_local_shared_cache_image) { + if (is_local_shared_cache_image && linkedit_section_sp) { // The load commands in shared cache images are relative to the // beginning of the shared cache, not the library image. The // data we get handed when creating the ObjectFileMachO starts diff --git a/lldb/unittests/ObjectFile/MachO/TestObjectFileMachO.cpp b/lldb/unittests/ObjectFile/MachO/TestObjectFileMachO.cpp index 147ea55e85efa..b3a238022aa57 100644 --- a/lldb/unittests/ObjectFile/MachO/TestObjectFileMachO.cpp +++ b/lldb/unittests/ObjectFile/MachO/TestObjectFileMachO.cpp @@ -15,8 +15,12 @@ #include "lldb/Core/ModuleSpec.h" #include "lldb/Host/FileSystem.h" #include "lldb/Host/HostInfo.h" +#include "lldb/Symbol/ObjectFile.h" +#include "lldb/Symbol/Symtab.h" #include "lldb/Utility/FileSpec.h" #include "lldb/lldb-defines.h" +#include "llvm/Testing/Support/Error.h" +#include "gmock/gmock.h" #include "gtest/gtest.h" #ifdef __APPLE__ @@ -107,3 +111,49 @@ TEST_F(ObjectFileMachOTest, IndirectSymbolsInTheSharedCache) { OF->ParseSymtab(symtab); } #endif + +// A Mach-O whose MH_DYLIB_IN_CACHE flag is set but which has no __LINKEDIT +// segment. +TEST_F(ObjectFileMachOTest, ParseSymtabSharedCacheMissingLinkedit) { + const char *yamldata = R"( +--- !mach-o +FileHeader: + magic: 0xFEEDFACF + cputype: 0x01000007 + cpusubtype: 0x00000003 + filetype: 0x00000006 + ncmds: 2 + sizeofcmds: 96 + flags: 0x80000000 + reserved: 0x00000000 +LoadCommands: + - cmd: LC_SEGMENT_64 + cmdsize: 72 + segname: __TEXT + vmaddr: 0 + vmsize: 4096 + fileoff: 0 + filesize: 0 + maxprot: 7 + initprot: 5 + nsects: 0 + flags: 0 + - cmd: LC_SYMTAB + cmdsize: 24 + symoff: 0 + nsyms: 0 + stroff: 0 + strsize: 0 +... +)"; + + llvm::Expected<TestFile> file = TestFile::fromYaml(yamldata); + ASSERT_THAT_EXPECTED(file, llvm::Succeeded()); + lldb::ModuleSP module = std::make_shared<Module>(file->moduleSpec()); + ObjectFile *OF = module->GetObjectFile(); + ASSERT_TRUE(llvm::isa<ObjectFileMachO>(OF)); + + // Simply no crashing is the regression check. + Symtab symtab(OF); + OF->ParseSymtab(symtab); +} _______________________________________________ lldb-commits mailing list [email protected] https://lists.llvm.org/cgi-bin/mailman/listinfo/lldb-commits
