[binutils-gdb] [gdb/exp] Fix UB in scalar_binop

[binutils-gdb] [gdb/exp] Fix UB in scalar_binop

[Tom de Vries]

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=5a3cf18c2ed9593f194ea22f50ea5651532f6cfc

commit 5a3cf18c2ed9593f194ea22f50ea5651532f6cfc
Author: Tom de Vries <tdevries@suse.de>
Date:   Mon May 23 14:50:02 2022 +0200

    [gdb/exp] Fix UB in scalar_binop
    
    When building gdb with -fsanitize=undefined, I run into:
    ...
    $ gdb -q -batch -ex "p -(-0x7fffffffffffffff - 1)"
    src/gdb/valarith.c:1385:10: runtime error: signed integer overflow: \
      0 - -9223372036854775808 cannot be represented in type 'long int'
    $1 = -9223372036854775808
    ...
    
    Fix this by performing the substraction in scalar_binop using unsigned types.
    
    Tested on x86_64-linux.

Diff:
---
 gdb/testsuite/gdb.base/arithmet.exp | 2 ++
 gdb/valarith.c                      | 5 ++++-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/gdb/testsuite/gdb.base/arithmet.exp b/gdb/testsuite/gdb.base/arithmet.exp
index b6009a36235..4905c2e2706 100644
--- a/gdb/testsuite/gdb.base/arithmet.exp
+++ b/gdb/testsuite/gdb.base/arithmet.exp
@@ -98,3 +98,5 @@ gdb_test "print x-(y+w)"  "3"
 gdb_test "print x/(y*w)"  "0"
 gdb_test "print x-(y/w)"  "9"
 gdb_test "print (x+y)*w" "42"
+
+gdb_test "p /x -(-0x7fffffffffffffff - 1)" " = 0x8000000000000000"
diff --git a/gdb/valarith.c b/gdb/valarith.c
index 6210267826e..526cc02599e 100644
--- a/gdb/valarith.c
+++ b/gdb/valarith.c
@@ -1382,7 +1382,10 @@ scalar_binop (struct value *arg1, struct value *arg2, enum exp_opcode op)
 	      break;
 
 	    case BINOP_SUB:
-	      v = v1 - v2;
+	      /* Avoid runtime error: signed integer overflow: \
+		 0 - -9223372036854775808 cannot be represented in type
+		 'long int'.  */
+	      v = (ULONGEST)v1 - (ULONGEST)v2;
 	      break;
 
 	    case BINOP_MUL: