commit 95997f6110b27cf4caab5c5ae9eec36d38126fec
author Zachary Turner <zturner@google.com> Thu Nov 15 05:06:59 2018 +0000
committer Zachary Turner <zturner@google.com> Thu Nov 15 05:06:59 2018 +0000
tree b7abd189a451b22ba21ea2a83f49b774824c4374
parent 77b33c86f50a7516085f361f22f2aa908dcd8e62

Fix a use-after-free of the ABI plugin.

This was introduced in r346775.  Previously the ABI shared_ptr
was declared as a function local static meaning it would live
forever.  After the change, someone has to create a strong
reference to it or it will go away.  In this code, we were
calling ABI::FindPlugin(...).get(), so it was being immediately
destroyed and we were holding onto a dangling pointer.

llvm-svn: 346932

lldb/source/Symbol/Variable.cpp

diff --git a/lldb/source/Symbol/Variable.cpp b/lldb/source/Symbol/Variable.cpp
index 429657c..2573c87 100644
--- a/lldb/source/Symbol/Variable.cpp
+++ b/lldb/source/Symbol/Variable.cpp
@@ -156,14 +156,14 @@
                                 .GetBaseAddress()
                                 .GetFileAddress();
     }
-    ABI *abi = nullptr;
+    ABISP abi;
     if (m_owner_scope) {
       ModuleSP module_sp(m_owner_scope->CalculateSymbolContextModule());
       if (module_sp)
-        abi = ABI::FindPlugin(ProcessSP(), module_sp->GetArchitecture()).get();
+        abi = ABI::FindPlugin(ProcessSP(), module_sp->GetArchitecture());
     }
     m_location.GetDescription(s, lldb::eDescriptionLevelBrief,
-                              loclist_base_addr, abi);
+                              loclist_base_addr, abi.get());
   }
 
   if (m_external)
@@ -458,11 +458,11 @@
     SymbolContext sc;
     CalculateSymbolContext(&sc);
     if (sc.module_sp == address.GetModule()) {
-      ABI *abi = nullptr;
+      ABISP abi;
       if (m_owner_scope) {
         ModuleSP module_sp(m_owner_scope->CalculateSymbolContextModule());
         if (module_sp)
-          abi = ABI::FindPlugin(ProcessSP(), module_sp->GetArchitecture()).get();
+          abi = ABI::FindPlugin(ProcessSP(), module_sp->GetArchitecture());
       }
 
       const addr_t file_addr = address.GetFileAddress();
@@ -474,11 +474,12 @@
             return false;
           return m_location.DumpLocationForAddress(s, eDescriptionLevelBrief,
                                                    loclist_base_file_addr,
-                                                   file_addr, abi);
+                                                   file_addr, abi.get());
         }
       }
-      return m_location.DumpLocationForAddress(
-          s, eDescriptionLevelBrief, LLDB_INVALID_ADDRESS, file_addr, abi);
+      return m_location.DumpLocationForAddress(s, eDescriptionLevelBrief,
+                                               LLDB_INVALID_ADDRESS, file_addr,
+                                               abi.get());
     }
   }
   return false;