Re: [PATCH] gdb: consider null terminator for length arguments of value_cstring calls

[Pedro Alves <pedro@palves.net>]

On 2021-07-13 4:31 p.m., Simon Marchi via Gdb-patches wrote:

> A way to expose the bug, as implemented in the new test, is to make an
> inferior function call with this value, using a function that reads the
> string until the null terminator.  That allocates some memory in the
> inferior for the string and copies it.  If the null terminator is
> missing, the function will read past the allocated buffer, possibly
> causing a crash.  In practice, the memory following the buffer must
> pretty often be zeroed-out, because I didn't see a crash just with this.
> But if we compile the inferior program with AddressSanitizer, then the
> out-of-bounds access causes a crash systematically.
> 
> It would be nice to find a test that does not require compiling the
> inferior program with AddressSanitizer, if somebody has a better idea,
> but at least I think it's better than no test.

Do we need to run a program at all?  How about simply something based on this?

Before patch:

 (gdb) maint set test-settings string foo
 (gdb) p $_gdb_maint_setting("test-settings string")
 $1 = "foo"
 (gdb) p $_gdb_maint_setting("test-settings string")[0]
 $2 = 102 'f'
 (gdb) p $_gdb_maint_setting("test-settings string")[1]
 $3 = 111 'o'
 (gdb) p $_gdb_maint_setting("test-settings string")[2]
 $4 = 111 'o'
 (gdb) p $_gdb_maint_setting("test-settings string")[3]
 no such vector element

After patch:

 (gdb) maint set test-settings string foo
 (gdb) p $_gdb_maint_setting("test-settings string")
 $1 = "foo"
 (gdb) p $_gdb_maint_setting("test-settings string")[0]
 $2 = 102 'f'
 (gdb) p $_gdb_maint_setting("test-settings string")[1]
 $3 = 111 'o'
 (gdb) p $_gdb_maint_setting("test-settings string")[2]
 $4 = 111 'o'
 (gdb) p $_gdb_maint_setting("test-settings string")[3]
 $5 = 0 '\000'
 (gdb) p $_gdb_maint_setting("test-settings string")[4]
 no such vector element