Repository navigation
source-map: validate file and symbol indices against array bounds - #9345
Open
TristanInSec wants to merge 2 commits into
Open
TristanInSec wants to merge 2 commits into
TristanInSec wants to merge 2 commits into
Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces bounds checking for VLQ-decoded file and symbol indices in the SourceMapReader to prevent out-of-bounds access by tracking the sizes of debugInfoFileNames and debugInfoSymbolNames. The review feedback points out a critical issue where the guards numFiles > 0 and numSymbols > 0 allow out-of-bounds indices to bypass validation when the respective arrays are empty. Removing these guards ensures that any index is correctly rejected when there are no files or symbols available.
The VLQ-decoded file and symbol indices in the source map reader are accumulated without checking that they stay within the sources/names arrays. A crafted source map can push them out of range, causing an OOB read when the indices are later used to look up debugInfoFileNames or debugInfoSymbolNames. Store the array sizes during parse() and reject out-of-range indices in readDebugLocationAt().
TristanInSec
force-pushed
the
fix-sourcemap-oob
branch
from
November 4, 2026 17:16
c732cc8 to
0f7880a
Compare
kripken
requested changes
Nov 5, 2026
kripken
left a comment
kripken
left a comment
Member
There was a problem hiding this comment.
Thanks, this looks correct, but please add a unit test in test/gtest/source-map.cpp
Add two tests that verify out-of-range VLQ-decoded file and symbol indices are rejected with MapParseException during readDebugLocationAt.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The VLQ-decoded
fileandsymbolindices in the source map reader are delta-encoded and accumulated with+=, but never checked against the actual size of thesources/namesarrays. A malformed source map can make them go out of range, which causes an OOB vector access later in Print.cpp when looking updebugInfoFileNames[fileIndex].This stores the array sizes during
parse()and rejects out-of-range indices inreadDebugLocationAt().