1#include <cstdio>
2#include <cstdlib>
3#include <stdint.h>
4#include <string>
5
6// For more information about libc++'s std::string ABI, see:
7//
8// https://joellaity.com/2020/01/31/string.html
9
10// A corrupt string which hits the SSO code path, but has an invalid size.
11static struct {
12#if _LIBCPP_ABI_VERSION == 1
13 // Set the size of this short-mode string to 116. Note that in short mode,
14 // the size is encoded as `size << 1`.
15 unsigned char size = 232;
16
17 // 23 garbage bytes for the inline string payload.
18 char inline_buf[23] = {0};
19#else // _LIBCPP_ABI_VERSION == 1
20 // Like above, but data comes first, and use bitfields to indicate size.
21 char inline_buf[23] = {0};
22 unsigned char size : 7 = 116;
23 unsigned char is_long : 1 = 0;
24#endif // #if _LIBCPP_ABI_VERSION == 1
25} garbage_string_short_mode;
26
27// A corrupt libcxx string in long mode with a payload that contains a utf8
28// sequence that's inherently too long.
29static unsigned char garbage_utf8_payload1[] = {
30 250, // This means that we expect a 5-byte sequence, this is invalid. LLDB
31 // should fall back to ASCII printing.
32 250, 250, 250};
33static struct {
34#if _LIBCPP_ABI_VERSION == 1
35 uint64_t cap = 5;
36 uint64_t size = 4;
37 unsigned char *data = &garbage_utf8_payload1[0];
38#else // _LIBCPP_ABI_VERSION == 1
39 unsigned char *data = &garbage_utf8_payload1[0];
40 uint64_t size = 4;
41 uint64_t cap : 63 = 4;
42 uint64_t is_long : 1 = 1;
43#endif // #if _LIBCPP_ABI_VERSION == 1
44} garbage_string_long_mode1;
45
46// A corrupt libcxx string in long mode with a payload that contains a utf8
47// sequence that's too long to fit in the buffer.
48static unsigned char garbage_utf8_payload2[] = {
49 240, // This means that we expect a 4-byte sequence, but the buffer is too
50 // small for this. LLDB should fall back to ASCII printing.
51 240};
52static struct {
53#if _LIBCPP_ABI_VERSION == 1
54 uint64_t cap = 3;
55 uint64_t size = 2;
56 unsigned char *data = &garbage_utf8_payload2[0];
57#else // _LIBCPP_ABI_VERSION == 1
58 unsigned char *data = &garbage_utf8_payload2[0];
59 uint64_t size = 2;
60 uint64_t cap : 63 = 3;
61 uint64_t is_long : 1 = 1;
62#endif // #if _LIBCPP_ABI_VERSION == 1
63} garbage_string_long_mode2;
64
65// A corrupt libcxx string which has an invalid size (i.e. a size greater than
66// the capacity of the string).
67static struct {
68#if _LIBCPP_ABI_VERSION == 1
69 uint64_t cap = 5;
70 uint64_t size = 7;
71 const char *data = "foo";
72#else // _LIBCPP_ABI_VERSION == 1
73 const char *data = "foo";
74 uint64_t size = 7;
75 uint64_t cap : 63 = 5;
76 uint64_t is_long : 1 = 1;
77#endif // #if _LIBCPP_ABI_VERSION == 1
78} garbage_string_long_mode3;
79
80// A corrupt libcxx string in long mode with a payload that would trigger a
81// buffer overflow.
82static struct {
83#if _LIBCPP_ABI_VERSION == 1
84 uint64_t cap = 5;
85 uint64_t size = 2;
86 uint64_t data = 0xfffffffffffffffeULL;
87#else // _LIBCPP_ABI_VERSION == 1
88 uint64_t data = 0xfffffffffffffffeULL;
89 uint64_t size = 2;
90 uint64_t cap : 63 = 5;
91 uint64_t is_long : 1 = 1;
92#endif // #if _LIBCPP_ABI_VERSION == 1
93} garbage_string_long_mode4;
94
95int main() {
96 std::string garbage1, garbage2, garbage3, garbage4, garbage5;
97 if (sizeof(std::string) == sizeof(garbage_string_short_mode))
98 memcpy((void *)&garbage1, &garbage_string_short_mode, sizeof(std::string));
99 if (sizeof(std::string) == sizeof(garbage_string_long_mode1))
100 memcpy((void *)&garbage2, &garbage_string_long_mode1, sizeof(std::string));
101 if (sizeof(std::string) == sizeof(garbage_string_long_mode2))
102 memcpy((void *)&garbage3, &garbage_string_long_mode2, sizeof(std::string));
103 if (sizeof(std::string) == sizeof(garbage_string_long_mode3))
104 memcpy((void *)&garbage4, &garbage_string_long_mode3, sizeof(std::string));
105 if (sizeof(std::string) == sizeof(garbage_string_long_mode4))
106 memcpy((void *)&garbage5, &garbage_string_long_mode4, sizeof(std::string));
107
108 std::puts(s: "// Set break point at this line.");
109 return 0;
110}
111

source code of lldb/test/API/functionalities/data-formatter/data-formatter-stl/libcxx/invalid-string/main.cpp