[binutils-gdb] gdb: add empty string check in parse_linespec

[binutils-gdb] gdb: add empty string check in parse_linespec

[Andrew Burgess]

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=8e454b9c61b6d3a80ea4bc840e808e1564d94ec7

commit 8e454b9c61b6d3a80ea4bc840e808e1564d94ec7
Author: Andrew Burgess <aburgess@redhat.com>
Date:   Tue Dec 7 13:25:47 2021 +0000

    gdb: add empty string check in parse_linespec
    
    If parse_linespec (linespec.c) is passed ARG as an empty string then
    we end up calling `strchr (linespec_quote_characters, '\0')`, which
    will return a pointer to the '\0' at the end of
    linespec_quote_characters.  This then results in GDB calling
    skip_quote_char with `ARG + 1`, which is undefined behaviour (as ARG
    only contained a single character, the '\0').
    
    Fix this by checking for the first character of ARG being '\0' before
    the call to strchr.
    
    I have additionally added an assertion that ARG can't itself be
    nullptr, as calling is_ada_operator with nullptr can end up calling
    'startswith' on the nullptr, which is undefined behaviour.
    
    Finally, I moved the declaration of TOKEN into the body of
    parse_linespec, to where TOKEN is defined.
    
    This patch came about while I was working on fixes for PR cli/28665
    and PR gdb/28797.  The actual fixes for these two issues will be in a
    later commit in this series, but, with this patch in place, both of
    the above bugs would hit the new assertion rather than accessing
    invalid memory and crashing.  The '\0' check is not currently ever
    hit, but just makes the code a little safer.
    
    Because this patch only changes the nature of the failure for the
    above two bugs, there's no tests here.  A later commit will fix the
    above two issues, at which point I'll add some tests.
    
    Bug: https://sourceware.org/bugzilla/show_bug.cgi?id=28665
    Bug: https://sourceware.org/bugzilla/show_bug.cgi?id=28797

Diff:
---
 gdb/linespec.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/gdb/linespec.c b/gdb/linespec.c
index b24cf30dc71..27ceaa41adb 100644
--- a/gdb/linespec.c
+++ b/gdb/linespec.c
@@ -2522,14 +2522,15 @@ convert_explicit_location_to_sals (struct linespec_state *self,
    if no file is validly specified.  Callers must check that.
    Also, the line number returned may be invalid.  */
 
-/* Parse the linespec in ARG.  MATCH_TYPE indicates how function names
-   should be matched.  */
+/* Parse the linespec in ARG, which must not be nullptr.  MATCH_TYPE
+   indicates how function names should be matched.  */
 
 static std::vector<symtab_and_line>
 parse_linespec (linespec_parser *parser, const char *arg,
 		symbol_name_match_type match_type)
 {
-  linespec_token token;
+  gdb_assert (arg != nullptr);
+
   struct gdb_exception file_exception;
 
   /* A special case to start.  It has become quite popular for
@@ -2538,11 +2539,10 @@ parse_linespec (linespec_parser *parser, const char *arg,
   parser->is_quote_enclosed = 0;
   if (parser->completion_tracker == NULL
       && !is_ada_operator (arg)
+      && *arg != '\0'
       && strchr (linespec_quote_characters, *arg) != NULL)
     {
-      const char *end;
-
-      end = skip_quote_char (arg + 1, *arg);
+      const char *end = skip_quote_char (arg + 1, *arg);
       if (end != NULL && is_closing_quote_enclosed (end))
 	{
 	  /* Here's the special case.  Skip ARG past the initial
@@ -2583,7 +2583,7 @@ parse_linespec (linespec_parser *parser, const char *arg,
   /* Start parsing.  */
 
   /* Get the first token.  */
-  token = linespec_lexer_consume_token (parser);
+  linespec_token token = linespec_lexer_consume_token (parser);
 
   /* It must be either LSTOKEN_STRING or LSTOKEN_NUMBER.  */
   if (token.type == LSTOKEN_STRING && *LS_TOKEN_STOKEN (token).ptr == '$')