From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 91937 invoked by alias); 8 Nov 2018 19:12:51 -0000 Mailing-List: contact gdb-patches-help@sourceware.org; run by ezmlm Precedence: bulk List-Id: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: gdb-patches-owner@sourceware.org Received: (qmail 91921 invoked by uid 89); 8 Nov 2018 19:12:50 -0000 Authentication-Results: sourceware.org; auth=none X-Spam-SWARE-Status: No, score=-0.9 required=5.0 tests=BAYES_00,KAM_LAZY_DOMAIN_SECURITY,SPF_HELO_PASS autolearn=no version=3.3.2 spammy=our X-HELO: mx1.redhat.com Received: from mx1.redhat.com (HELO mx1.redhat.com) (209.132.183.28) by sourceware.org (qpsmtpd/0.93/v0.84-503-g423c35a) with ESMTP; Thu, 08 Nov 2018 19:12:49 +0000 Received: from smtp.corp.redhat.com (int-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id C06A83B7F; Thu, 8 Nov 2018 19:12:48 +0000 (UTC) Received: from [127.0.0.1] (ovpn04.gateway.prod.ext.ams2.redhat.com [10.39.146.4]) by smtp.corp.redhat.com (Postfix) with ESMTP id EFAC5604D9; Thu, 8 Nov 2018 19:12:47 +0000 (UTC) Subject: Re: [PATCH] Fix buffer overflow in ada-lang.c:move_bits To: Joel Brobecker , Tom Tromey References: <20181024162037.21024-1-tom@tromey.com> <20181101153517.GA2705@adacore.com> <082f66ea-223b-52f4-bc24-b274dbcf4f01@redhat.com> Cc: gdb-patches@sourceware.org From: Pedro Alves Message-ID: <609409e6-235a-4724-3ced-57c3ff42e299@redhat.com> Date: Thu, 08 Nov 2018 19:12:00 -0000 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.9.1 MIME-Version: 1.0 In-Reply-To: <082f66ea-223b-52f4-bc24-b274dbcf4f01@redhat.com> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit X-SW-Source: 2018-11/txt/msg00129.txt.bz2 On 11/08/2018 07:11 PM, Pedro Alves wrote: > On 11/01/2018 03:35 PM, Joel Brobecker wrote: >> Hi Tom, >> >>> -fsanitize=address showed that ada-lang.c:move_bits can run off the >>> end of the source buffer. I believe this patch fixes the problem, by >>> arranging not to read from the source buffer once there are sufficient >>> bits in the accumulator. >>> >>> gdb/ChangeLog >>> 2018-10-23 Tom Tromey >>> >>> * ada-lang.c (move_bits): Don't run off the end of the source >>> buffer. >> >> Thanks for the patch! >> >> This is a part of the code that always forces me to think twice >> (or ten times), each time I try to touch it. I should really start >> adding comments to this code that detail what we are trying to do >> as we do it. >> >> I tested your change through our testsuite on the various baremetal >> targets we have, and noticed that it causes regressions on ppc and arm >> targets. It's hopefully something small, but just being back from >> a holiday, I'm a bit tied up at work; I'll put that issue on my TODO >> list to look at further. > > I was going to suggest that this would benefit from unit tests in > the style of dwarf2read.c:copy_bitwise's, but, actually, isn't this > exactly the same as copy_bitwise? Can we get rid of ada-lang.c:move_bits? > (And maybe move copy_bitwise elsewhere?) I meant to say dwarf2loc.c instead of dwarf2read.c. Thanks, Pedro Alves