* [PATCH] gdb: fix off-by-one error in quirk_rust_enum
@ 2020-05-19 18:15 Simon Marchi
2020-05-19 18:18 ` Tom Tromey
0 siblings, 1 reply; 3+ messages in thread
From: Simon Marchi @ 2020-05-19 18:15 UTC (permalink / raw)
To: gdb-patches; +Cc: Simon Marchi
Found by inspection, so I don't have a test for it (I don't think it
would be easy to have this bug cause a failure reliably).
We allocate space for N fields into `new_fields`, then memcpy N fields
at `new_fields + 1`. This overflows the allocated buffer by one field.
Fix it by allocating `N + 1` fields.
gdb/ChangeLog:
* dwarf2/read.c (quirk_rust_enum): Allocate enough fields.
---
gdb/dwarf2/read.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/gdb/dwarf2/read.c b/gdb/dwarf2/read.c
index 0c6182bbf3b9..2ab7c5c33131 100644
--- a/gdb/dwarf2/read.c
+++ b/gdb/dwarf2/read.c
@@ -9420,7 +9420,7 @@ quirk_rust_enum (struct type *type, struct objfile *objfile)
/* Make space for the discriminant field. */
struct field *disr_field = &TYPE_FIELD (disr_type, 0);
field *new_fields
- = (struct field *) TYPE_ZALLOC (type, (TYPE_NFIELDS (type)
+ = (struct field *) TYPE_ZALLOC (type, ((TYPE_NFIELDS (type) + 1)
* sizeof (struct field)));
memcpy (new_fields + 1, TYPE_FIELDS (type),
TYPE_NFIELDS (type) * sizeof (struct field));
--
2.26.2
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] gdb: fix off-by-one error in quirk_rust_enum
2020-05-19 18:15 [PATCH] gdb: fix off-by-one error in quirk_rust_enum Simon Marchi
@ 2020-05-19 18:18 ` Tom Tromey
2020-05-19 18:21 ` Simon Marchi
0 siblings, 1 reply; 3+ messages in thread
From: Tom Tromey @ 2020-05-19 18:18 UTC (permalink / raw)
To: Simon Marchi via Gdb-patches; +Cc: Simon Marchi
>>>>> "Simon" == Simon Marchi via Gdb-patches <gdb-patches@sourceware.org> writes:
Simon> Found by inspection, so I don't have a test for it (I don't think it
Simon> would be easy to have this bug cause a failure reliably).
Simon> We allocate space for N fields into `new_fields`, then memcpy N fields
Simon> at `new_fields + 1`. This overflows the allocated buffer by one field.
Simon> Fix it by allocating `N + 1` fields.
Simon> gdb/ChangeLog:
Simon> * dwarf2/read.c (quirk_rust_enum): Allocate enough fields.
Looks good. Thank you.
Tom
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] gdb: fix off-by-one error in quirk_rust_enum
2020-05-19 18:18 ` Tom Tromey
@ 2020-05-19 18:21 ` Simon Marchi
0 siblings, 0 replies; 3+ messages in thread
From: Simon Marchi @ 2020-05-19 18:21 UTC (permalink / raw)
To: Tom Tromey, Simon Marchi via Gdb-patches
On 2020-05-19 2:18 p.m., Tom Tromey wrote:
>>>>>> "Simon" == Simon Marchi via Gdb-patches <gdb-patches@sourceware.org> writes:
>
> Simon> Found by inspection, so I don't have a test for it (I don't think it
> Simon> would be easy to have this bug cause a failure reliably).
>
> Simon> We allocate space for N fields into `new_fields`, then memcpy N fields
> Simon> at `new_fields + 1`. This overflows the allocated buffer by one field.
>
> Simon> Fix it by allocating `N + 1` fields.
>
> Simon> gdb/ChangeLog:
>
> Simon> * dwarf2/read.c (quirk_rust_enum): Allocate enough fields.
>
> Looks good. Thank you.
>
> Tom
>
Thanks, pushed.
Simon
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2020-05-19 18:21 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-05-19 18:15 [PATCH] gdb: fix off-by-one error in quirk_rust_enum Simon Marchi
2020-05-19 18:18 ` Tom Tromey
2020-05-19 18:21 ` Simon Marchi
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).