[LLDB]Fix buffer-over-flow bug introduced in 157170

[oontvoo]

If pr_name is longer than 16, it would be a non-null terminated string. Assigning it to std::string m_executable_name would cause an overflow read. Instead, just copy the name from thread_data.name.

To repro, run the elf-core/TestLinuxCore.py with asan
(Question: why is the new variable needed in the first place? can't the thread_data.name be used?)

[llvmbot]

@llvm/pr-subscribers-lldb

Author: Vy Nguyen (oontvoo)

Changes

If pr_name is longer than 16, it would be a non-null terminated string. Assigning it to std::string m_executable_name would cause an overflow read. Instead, just copy the name from thread_data.name.

(Question: why is the new variable needed in the first place? can't the thread_data.name be used?)

---

Full diff: https://github.com/llvm/llvm-project/pull/159588.diff

1 Files Affected:

• (modified) lldb/source/Plugins/Process/elf-core/ProcessElfCore.cpp (+1-1)

diff --git a/lldb/source/Plugins/Process/elf-core/ProcessElfCore.cpp b/lldb/source/Plugins/Process/elf-core/ProcessElfCore.cpp
index 8f5f1242116f5..38bf13543c617 100644
--- a/lldb/source/Plugins/Process/elf-core/ProcessElfCore.cpp
+++ b/lldb/source/Plugins/Process/elf-core/ProcessElfCore.cpp
@@ -952,7 +952,7 @@ llvm::Error ProcessElfCore::parseLinuxNotes(llvm::ArrayRef<CoreNote> notes) {
         return status.ToError();
       thread_data.name.assign (prpsinfo.pr_fname, strnlen (prpsinfo.pr_fname, sizeof (prpsinfo.pr_fname)));
       SetID(prpsinfo.pr_pid);
-      m_executable_name = prpsinfo.pr_fname;
+      m_executable_name = thread_data.name;
       break;
     }
     case ELF::NT_SIGINFO: {

[dmpots]

Thanks for the fix. The new variable m_executable_name is used to save the name so that we can find the NT_FILE entries for the main executable, which is handled in a different part of the code.

There is the same fix in #159375.

[oontvoo]

Thanks for the fix. The new variable m_executable_name is used to save the name so that we can find the NT_FILE entries for the main executable, which is handled in a different part of the code.

There is the same fix in #159375.

Oops, my bad - hadn't noticed the existing fix. This was breaking our internal build so I thought I'd just merge the fix quickly.