public inbox for gdb-patches@sourceware.org
 help / color / mirror / Atom feed
From: Andrew Burgess <aburgess@redhat.com>
To: gdb-patches@sourceware.org
Cc: Andrew Burgess <aburgess@redhat.com>
Subject: [PATCHv2 2/6] gdb: add empty string check in parse_linespec
Date: Thu, 27 Jan 2022 17:47:40 +0000	[thread overview]
Message-ID: <75e7873ae13e6c975d272024a5a443e36e68aa2f.1643305429.git.aburgess@redhat.com> (raw)
In-Reply-To: <cover.1643305429.git.aburgess@redhat.com>

If parse_linespec (linespec.c) is passed ARG as an empty string then
we end up calling `strchr (linespec_quote_characters, '\0')`, which
will return a pointer to the '\0' at the end of
linespec_quote_characters.  This then results in GDB calling
skip_quote_char with `ARG + 1`, which is undefined behaviour (as ARG
only contained a single character, the '\0').

Fix this by checking for the first character of ARG being '\0' before
the call to strchr.

I have additionally added an assertion that ARG can't itself be
nullptr, as calling is_ada_operator with nullptr can end up calling
'startswith' on the nullptr, which is undefined behaviour.

Finally, I moved the declaration of TOKEN into the body of
parse_linespec, to where TOKEN is defined.

This patch came about while I was working on fixes for PR cli/28665
and PR gdb/28797.  The actual fixes for these two issues will be in a
later commit in this series, but, with this patch in place, both of
the above bugs would hit the new assertion rather than accessing
invalid memory and crashing.  The '\0' check is not currently ever
hit, but just makes the code a little safer.

Because this patch only changes the nature of the failure for the
above two bugs, there's no tests here.  A later commit will fix the
above two issues, at which point I'll add some tests.

Bug: https://sourceware.org/bugzilla/show_bug.cgi?id=28665
Bug: https://sourceware.org/bugzilla/show_bug.cgi?id=28797
---
 gdb/linespec.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/gdb/linespec.c b/gdb/linespec.c
index b24cf30dc71..27ceaa41adb 100644
--- a/gdb/linespec.c
+++ b/gdb/linespec.c
@@ -2522,14 +2522,15 @@ convert_explicit_location_to_sals (struct linespec_state *self,
    if no file is validly specified.  Callers must check that.
    Also, the line number returned may be invalid.  */
 
-/* Parse the linespec in ARG.  MATCH_TYPE indicates how function names
-   should be matched.  */
+/* Parse the linespec in ARG, which must not be nullptr.  MATCH_TYPE
+   indicates how function names should be matched.  */
 
 static std::vector<symtab_and_line>
 parse_linespec (linespec_parser *parser, const char *arg,
 		symbol_name_match_type match_type)
 {
-  linespec_token token;
+  gdb_assert (arg != nullptr);
+
   struct gdb_exception file_exception;
 
   /* A special case to start.  It has become quite popular for
@@ -2538,11 +2539,10 @@ parse_linespec (linespec_parser *parser, const char *arg,
   parser->is_quote_enclosed = 0;
   if (parser->completion_tracker == NULL
       && !is_ada_operator (arg)
+      && *arg != '\0'
       && strchr (linespec_quote_characters, *arg) != NULL)
     {
-      const char *end;
-
-      end = skip_quote_char (arg + 1, *arg);
+      const char *end = skip_quote_char (arg + 1, *arg);
       if (end != NULL && is_closing_quote_enclosed (end))
 	{
 	  /* Here's the special case.  Skip ARG past the initial
@@ -2583,7 +2583,7 @@ parse_linespec (linespec_parser *parser, const char *arg,
   /* Start parsing.  */
 
   /* Get the first token.  */
-  token = linespec_lexer_consume_token (parser);
+  linespec_token token = linespec_lexer_consume_token (parser);
 
   /* It must be either LSTOKEN_STRING or LSTOKEN_NUMBER.  */
   if (token.type == LSTOKEN_STRING && *LS_TOKEN_STOKEN (token).ptr == '$')
-- 
2.25.4


  parent reply	other threads:[~2022-01-27 17:47 UTC|newest]

Thread overview: 16+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-12-07 23:13 [PATCH 0/5] Fix for 'list task 123' (PR cli/28668) Andrew Burgess
2021-12-07 23:13 ` [PATCH 1/5] gdb: update the comment on string_to_event_location Andrew Burgess
2021-12-07 23:13 ` [PATCH 2/5] gdb: add empty string check in parse_linespec Andrew Burgess
2021-12-07 23:13 ` [PATCH 3/5] gdb/testsuite: move linespec test into gdb.linespec/ directory Andrew Burgess
2021-12-07 23:13 ` [PATCH 4/5] gdb: handle calls to list command passing only a linespec condition Andrew Burgess
2021-12-07 23:13 ` [PATCH 5/5] gdb: handle calls to edit " Andrew Burgess
2021-12-07 23:18 ` [PATCH 0/5] Fix for 'list task 123' (PR cli/28668) Andrew Burgess
2022-01-27 17:47 ` [PATCHv2 0/6] Fix for 'list task 123' (PR cli/28665) Andrew Burgess
2022-01-27 17:47   ` [PATCHv2 1/6] gdb: update the comment on string_to_event_location Andrew Burgess
2022-01-27 17:47   ` Andrew Burgess [this message]
2022-01-27 17:47   ` [PATCHv2 3/6] gdb/testsuite: move linespec test into gdb.linespec/ directory Andrew Burgess
2022-01-27 17:47   ` [PATCHv2 4/6] gdb: handle calls to list command passing only a linespec condition Andrew Burgess
2022-01-27 17:47   ` [PATCHv2 5/6] gdb: handle calls to edit " Andrew Burgess
2022-01-27 17:47   ` [PATCHv2 6/6] gdb: test to check one aspect of the linespec parsing code Andrew Burgess
2022-01-27 20:35   ` [PATCHv2 0/6] Fix for 'list task 123' (PR cli/28665) Tom Tromey
2022-02-02 16:32     ` Andrew Burgess

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=75e7873ae13e6c975d272024a5a443e36e68aa2f.1643305429.git.aburgess@redhat.com \
    --to=aburgess@redhat.com \
    --cc=gdb-patches@sourceware.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).