Skip to content

Commit b8d66cb

Browse files
handle TOCTTOU stack reads
1 parent 29e0457 commit b8d66cb

File tree

1 file changed

+18
-8
lines changed

1 file changed

+18
-8
lines changed

luceedebug/src/main/java/luceedebug/coreinject/DebugManager.java

Lines changed: 18 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -392,16 +392,26 @@ public boolean evaluateAsBooleanForConditionalBreakpoint(Thread thread, String e
392392
if (stack == null) {
393393
return false;
394394
}
395-
if (stack.isEmpty()) {
396-
return false;
397-
}
398-
399-
DebugFrame frame = stack.get(stack.size() - 1);
400395

401-
if (frame instanceof Frame) {
402-
return doEvaluateAsBoolean((Frame)frame, expr);
396+
// We have observed concurrent read/writes here to the stack frame list, where the expected frame is popped off the stack
397+
// somewhere between determining the index of the last element and attempting to access the last element.
398+
// It is not expected to happen often, so just catch/log/return false in this case.
399+
try {
400+
if (stack.isEmpty()) {
401+
return false;
402+
}
403+
404+
DebugFrame frame = stack.get(stack.size() - 1); // n.b. stack can be empty despite our prior check
405+
406+
if (frame instanceof Frame) {
407+
return doEvaluateAsBoolean((Frame)frame, expr);
408+
}
409+
else {
410+
return false;
411+
}
403412
}
404-
else {
413+
catch (IndexOutOfBoundsException e) {
414+
System.out.println("[luceedebug]: evaluateAsBooleanForConditionalBreakpoint oob stack read, returning `false`");
405415
return false;
406416
}
407417
}

0 commit comments

Comments
 (0)