Guard against the case where the Write method is called with

an argument pointing into the middle of m_buffer and then
Write() calls GrowBuffer() to resize m_buffer, leaving
the content argument pointing into deallocated memory.

Patch by Kate Stone.
<rdar://problem/20756722>

llvm-svn: 236286

diff --git a/lldb/source/Core/FastDemangle.cpp b/lldb/source/Core/FastDemangle.cpp
index 53e8972..0f12af2 100644 (file)
--- a/lldb/source/Core/FastDemangle.cpp
+++ b/lldb/source/Core/FastDemangle.cpp
@@ -383,10 +383,19 @@ private:
         char *end_m_write_ptr = m_write_ptr + content_length;
         if (end_m_write_ptr > m_buffer_end)
         {
-            GrowBuffer(end_m_write_ptr - m_buffer_end);
+            if (content >= m_buffer && content < m_buffer_end) 
+            {
+                long offset = content - m_buffer;
+                GrowBuffer (end_m_write_ptr - m_buffer_end);
+                content = m_buffer + offset;
+            }
+            else 
+            {
+                GrowBuffer (end_m_write_ptr - m_buffer_end);
+            }
             end_m_write_ptr = m_write_ptr + content_length;
         }
-        memcpy(m_write_ptr, content, content_length);
+        memcpy (m_write_ptr, content, content_length);
         m_write_ptr = end_m_write_ptr;
     }
 #define WRITE(x) Write(x, sizeof (x) - 1)