Skip to content

Commit 3beaa12

Browse files
xusheng6claude
andcommitted
[emulator] Don't let map allocation failures cross the C ABI boundary
MapMemory allocates a buffer of a caller-controlled length; a std::bad_alloc / length_error from a huge or garbage length would propagate out of the extern "C" map functions, which is undefined behavior. Catch allocation failures in EmulatorMemory::Map (the single point the four map FFI entry points funnel through) and turn them into a logged no-op. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
1 parent 8103cc2 commit 3beaa12

1 file changed

Lines changed: 24 additions & 2 deletions

File tree

plugins/emulator/core/ilemulator.cpp

Lines changed: 24 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -204,7 +204,18 @@ void EmulatorMemory::Map(uint64_t addr, const void* data, size_t len, const std:
204204
}
205205
Segment seg;
206206
seg.start = addr;
207-
seg.data.assign((const uint8_t*)data, (const uint8_t*)data + len);
207+
try
208+
{
209+
seg.data.assign((const uint8_t*)data, (const uint8_t*)data + len);
210+
}
211+
catch (const std::exception& e)
212+
{
213+
// Do not let an allocation failure for a caller-controlled length escape across the
214+
// extern "C" ABI boundary (that would be undefined behavior).
215+
LogWarn("Emulator: failed to map region '%s' at 0x%llx (size 0x%zx): %s",
216+
name.c_str(), (unsigned long long)addr, len, e.what());
217+
return;
218+
}
208219
seg.name = name;
209220
m_segments.push_back(std::move(seg));
210221
}
@@ -222,7 +233,18 @@ void EmulatorMemory::Map(uint64_t addr, size_t len, const std::string& name)
222233
}
223234
Segment seg;
224235
seg.start = addr;
225-
seg.data.resize(len, 0);
236+
try
237+
{
238+
seg.data.resize(len, 0);
239+
}
240+
catch (const std::exception& e)
241+
{
242+
// Do not let an allocation failure for a caller-controlled length escape across the
243+
// extern "C" ABI boundary (that would be undefined behavior).
244+
LogWarn("Emulator: failed to map region '%s' at 0x%llx (size 0x%zx): %s",
245+
name.c_str(), (unsigned long long)addr, len, e.what());
246+
return;
247+
}
226248
seg.name = name;
227249
m_segments.push_back(std::move(seg));
228250
}

0 commit comments

Comments
 (0)