[PATCH 0/2] Fix crash when accessing symbol value from Python API

[PATCH 0/2] Fix crash when accessing symbol value from Python API

[Andrew Burgess]

Found a case where using Symbol.value method from the Python API can
cause GDB to crash.

---

Andrew Burgess (2):
  gdb: use gdb_assert not internal_error
  gdb: fix crash when getting the value of a label symbol

 gdb/findvar.c                                 | 18 +++------
 .../gdb.python/py-label-symbol-value.c        | 38 +++++++++++++++++++
 .../gdb.python/py-label-symbol-value.exp      | 38 +++++++++++++++++++
 3 files changed, 82 insertions(+), 12 deletions(-)
 create mode 100644 gdb/testsuite/gdb.python/py-label-symbol-value.c
 create mode 100644 gdb/testsuite/gdb.python/py-label-symbol-value.exp


base-commit: fa59ab98685e4b5431d2be423f449df5069a454e
-- 
2.25.4

[PATCH 1/2] gdb: use gdb_assert not internal_error

[Andrew Burgess]

Spotted a couple of places in findvar.c where we use:

  if ( ! CONDITION )
    internal_error ("...");

this commit changes these to be:

  gdb_assert ( CONDITION );

which I think is better.

Unless we happen to hit the internal_error calls (which was bad) there
should be no user visible changes after this commit.
---
 gdb/findvar.c | 10 ++--------
 1 file changed, 2 insertions(+), 8 deletions(-)

diff --git a/gdb/findvar.c b/gdb/findvar.c
index 91de3fd5c3e..e609358df08 100644
--- a/gdb/findvar.c
+++ b/gdb/findvar.c
@@ -152,10 +152,7 @@ extract_long_unsigned_integer (const gdb_byte *addr, int orig_len,
 CORE_ADDR
 extract_typed_address (const gdb_byte *buf, struct type *type)
 {
-  if (!type->is_pointer_or_reference ())
-    internal_error (_("extract_typed_address: "
-		    "type is not a pointer or reference"));
-
+  gdb_assert (type->is_pointer_or_reference ());
   return gdbarch_pointer_to_address (type->arch (), type, buf);
 }
 
@@ -204,10 +201,7 @@ template void store_integer (gdb_byte *addr, int len,
 void
 store_typed_address (gdb_byte *buf, struct type *type, CORE_ADDR addr)
 {
-  if (!type->is_pointer_or_reference ())
-    internal_error (_("store_typed_address: "
-		    "type is not a pointer or reference"));
-
+  gdb_assert (type->is_pointer_or_reference ());
   gdbarch_address_to_pointer (type->arch (), type, buf, addr);
 }
 
-- 
2.25.4

Re: [PATCH 1/2] gdb: use gdb_assert not internal_error

[Tom Tromey]

>>>>> "Andrew" == Andrew Burgess via Gdb-patches <gdb-patches@sourceware.org> writes:

Andrew> Spotted a couple of places in findvar.c where we use:
Andrew>   if ( ! CONDITION )
Andrew>     internal_error ("...");

Andrew> this commit changes these to be:

Andrew>   gdb_assert ( CONDITION );

Andrew> which I think is better.

Looks good.  From my perspective this is generally desirable and I'd
support considering it obvious.

Tom

Re: [PATCH 1/2] gdb: use gdb_assert not internal_error

[Andrew Burgess]

Tom Tromey <tom@tromey.com> writes:

>>>>>> "Andrew" == Andrew Burgess via Gdb-patches <gdb-patches@sourceware.org> writes:
>
> Andrew> Spotted a couple of places in findvar.c where we use:
> Andrew>   if ( ! CONDITION )
> Andrew>     internal_error ("...");
>
> Andrew> this commit changes these to be:
>
> Andrew>   gdb_assert ( CONDITION );
>
> Andrew> which I think is better.
>
> Looks good.  From my perspective this is generally desirable and I'd
> support considering it obvious.

Thanks, pushed.

Andrew

[PATCH 2/2] gdb: fix crash when getting the value of a label symbol

[Andrew Burgess]

When the source program contains a goto label, it turns out it's
actually pretty hard for a user to find out more about that label.
For example:

  (gdb) p some_label
  No symbol "some_label" in current context.
  (gdb) disassemble some_label
  No symbol "some_label" in current context.
  (gdb) x/10i some_label
  No symbol "some_label" in current context.
  (gdb) break some_label
  Breakpoint 2 at 0x401135: file /tmp/py-label-symbol-value.c, line 35.

In all cases, some_label is a goto label within the current frame.
Only placing a breakpoint on the label worked.

This all seems a little strange to me, it feels like asking about a
goto label would not be an unreasonable thing for a user to do.

This commit doesn't fix any of the above issues, I mention them just
to provide a little context for why the following issue has probably
not been seen before.

It turns out there is one way a user can access the symbol for a goto
label, through the Python API:

  python frame = gdb.selected_frame()
  python frame_pc = frame.pc()
  python block = gdb.current_progspace().block_for_pc(frame_pc)
  python symbol,_ = gdb.lookup_symbol('some_label', block, gdb.SYMBOL_LABEL_DOMAIN)
  python print(str(symbol.value()))
  ../../src/gdb/findvar.c:204: internal-error: store_typed_address: Assertion `type->is_pointer_or_reference ()' failed.

The problem is that label symbols are created using the
builtin_core_addr type, which is a pure integer type.

When GDB tries to fetch the value of a label symbol then we end up in
findvar.c, in the function language_defn::read_var_value, in the
LOC_LABEL case.  From here store_typed_address is called to store the
address of the label into a value object with builtin_core_addr type.

The problem is that store_typed_address requires that the destination
type be a pointer or reference, which the builtin_core_addr type is
not.

The fix I propose is to change the type used for the value of the
label symbol, instead of using builtin_core_addr type, we could use
builtin_func_ptr, after this calling store_typed_address is fine (the
call to store_typed_address is done indirectly through
value_from_pointer).

After this asking for the value of a label symbol works just fine:

  (gdb) python print(str(symbol.value()))
  0x401135 <main+35>
---
 gdb/findvar.c                                 |  8 ++--
 .../gdb.python/py-label-symbol-value.c        | 38 +++++++++++++++++++
 .../gdb.python/py-label-symbol-value.exp      | 38 +++++++++++++++++++
 3 files changed, 80 insertions(+), 4 deletions(-)
 create mode 100644 gdb/testsuite/gdb.python/py-label-symbol-value.c
 create mode 100644 gdb/testsuite/gdb.python/py-label-symbol-value.exp

diff --git a/gdb/findvar.c b/gdb/findvar.c
index e609358df08..cc4e14616c0 100644
--- a/gdb/findvar.c
+++ b/gdb/findvar.c
@@ -594,17 +594,17 @@ language_defn::read_var_value (struct symbol *var,
 
     case LOC_LABEL:
       /* Put the constant back in target format.  */
-      v = allocate_value (type);
       if (overlay_debugging)
 	{
 	  struct objfile *var_objfile = var->objfile ();
 	  addr = symbol_overlayed_address (var->value_address (),
 					   var->obj_section (var_objfile));
-	  store_typed_address (value_contents_raw (v).data (), type, addr);
 	}
       else
-	store_typed_address (value_contents_raw (v).data (), type,
-			      var->value_address ());
+	addr = var->value_address ();
+
+      type = builtin_type (var->arch ())->builtin_func_ptr;
+      v = value_from_pointer (type, addr);
       VALUE_LVAL (v) = not_lval;
       return v;
 
diff --git a/gdb/testsuite/gdb.python/py-label-symbol-value.c b/gdb/testsuite/gdb.python/py-label-symbol-value.c
new file mode 100644
index 00000000000..94bdae6fd30
--- /dev/null
+++ b/gdb/testsuite/gdb.python/py-label-symbol-value.c
@@ -0,0 +1,38 @@
+/* This testcase is part of GDB, the GNU debugger.
+
+   Copyright 2022 Free Software Foundation, Inc.
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see  <http://www.gnu.org/licenses/>.  */
+
+volatile int global_var = 1;
+
+int
+get_value ()
+{
+  return global_var;
+}
+
+int
+main (void)
+{
+  int value = get_value ();
+  if (value > 0)
+    goto some_label;
+
+  return 1;
+
+ some_label:
+
+  return 0;
+}
diff --git a/gdb/testsuite/gdb.python/py-label-symbol-value.exp b/gdb/testsuite/gdb.python/py-label-symbol-value.exp
new file mode 100644
index 00000000000..ccdd4b239ac
--- /dev/null
+++ b/gdb/testsuite/gdb.python/py-label-symbol-value.exp
@@ -0,0 +1,38 @@
+# Copyright 2022 Free Software Foundation, Inc.
+
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# Check that GDB handles the user asking for the value of a label
+# symbol (i.e. a symbol for a goto label).
+
+load_lib gdb-python.exp
+standard_testfile
+
+if { [prepare_for_testing "failed to prepare" ${testfile} ${srcfile}] } {
+    return -1
+}
+
+# Skip all tests if Python scripting is not enabled.
+if { [skip_python_tests] } { continue }
+
+if ![runto_main] {
+   return -1
+}
+
+# Use Python to print the value of the 'some_label' symbol.
+gdb_test "python frame = gdb.selected_frame()"
+gdb_test "python frame_pc = frame.pc()"
+gdb_test "python block = gdb.current_progspace().block_for_pc(frame_pc)"
+gdb_test "python symbol,_ = gdb.lookup_symbol('some_label', block, gdb.SYMBOL_LABEL_DOMAIN)"
+gdb_test "python print(str(symbol.value()))" "$hex <main\\+$decimal>"
-- 
2.25.4

Re: [PATCH 2/2] gdb: fix crash when getting the value of a label symbol

[Tom Tromey]

>>>>> "Andrew" == Andrew Burgess via Gdb-patches <gdb-patches@sourceware.org> writes:

Andrew>   (gdb) p some_label
Andrew>   No symbol "some_label" in current context.
...
Andrew> This all seems a little strange to me, it feels like asking about a
Andrew> goto label would not be an unreasonable thing for a user to do.

The issue is that that in C, there's no way to refer to a label in an
expression, so we'd need an extension of some kind.  GNU C has the "&&"
address-of-label extension, I suppose we could do that:

(info "(gcc) Labels as Values")

Andrew> The problem is that label symbols are created using the
Andrew> builtin_core_addr type, which is a pure integer type.

Andrew> The fix I propose is to change the type used for the value of the
Andrew> label symbol, instead of using builtin_core_addr type, we could use
Andrew> builtin_func_ptr, after this calling store_typed_address is fine (the
Andrew> call to store_typed_address is done indirectly through
Andrew> value_from_pointer).

In the GNU C extension, a label value uses "void *" as the type.

Unclear to me which is preferable, or if users are even likely to notice
or care if we decide to change it (like, when/if we implement the
extension).

Anyway the patch looks fine to me.

Tom

Re: [PATCH 2/2] gdb: fix crash when getting the value of a label symbol

[Andrew Burgess]

Tom Tromey <tom@tromey.com> writes:

>>>>>> "Andrew" == Andrew Burgess via Gdb-patches <gdb-patches@sourceware.org> writes:
>
> Andrew>   (gdb) p some_label
> Andrew>   No symbol "some_label" in current context.
> ...
> Andrew> This all seems a little strange to me, it feels like asking about a
> Andrew> goto label would not be an unreasonable thing for a user to do.
>
> The issue is that that in C, there's no way to refer to a label in an
> expression, so we'd need an extension of some kind.  GNU C has the "&&"
> address-of-label extension, I suppose we could do that:
>
> (info "(gcc) Labels as Values")
>
> Andrew> The problem is that label symbols are created using the
> Andrew> builtin_core_addr type, which is a pure integer type.
>
> Andrew> The fix I propose is to change the type used for the value of the
> Andrew> label symbol, instead of using builtin_core_addr type, we could use
> Andrew> builtin_func_ptr, after this calling store_typed_address is fine (the
> Andrew> call to store_typed_address is done indirectly through
> Andrew> value_from_pointer).
>
> In the GNU C extension, a label value uses "void *" as the type.
>
> Unclear to me which is preferable, or if users are even likely to notice
> or care if we decide to change it (like, when/if we implement the
> extension).

How about I just change to use 'void *' now?

The updated patch below now creates a value of type 'void *', and the
test checks that this is the case.

How's this?

Thanks,
Andrew

---

commit 3c469df9e5cacbb368edc661a1efaea728588a78
Author: Andrew Burgess <aburgess@redhat.com>
Date:   Mon Dec 12 14:05:22 2022 +0000

    gdb: fix crash when getting the value of a label symbol
    
    When the source program contains a goto label, it turns out it's
    actually pretty hard for a user to find out more about that label.
    For example:
    
      (gdb) p some_label
      No symbol "some_label" in current context.
      (gdb) disassemble some_label
      No symbol "some_label" in current context.
      (gdb) x/10i some_label
      No symbol "some_label" in current context.
      (gdb) break some_label
      Breakpoint 2 at 0x401135: file /tmp/py-label-symbol-value.c, line 35.
    
    In all cases, some_label is a goto label within the current frame.
    Only placing a breakpoint on the label worked.
    
    This all seems a little strange to me, it feels like asking about a
    goto label would not be an unreasonable thing for a user to do.
    
    This commit doesn't fix any of the above issues, I mention them just
    to provide a little context for why the following issue has probably
    not been seen before.
    
    It turns out there is one way a user can access the symbol for a goto
    label, through the Python API:
    
      python frame = gdb.selected_frame()
      python frame_pc = frame.pc()
      python block = gdb.current_progspace().block_for_pc(frame_pc)
      python symbol,_ = gdb.lookup_symbol('some_label', block, gdb.SYMBOL_LABEL_DOMAIN)
      python print(str(symbol.value()))
      ../../src/gdb/findvar.c:204: internal-error: store_typed_address: Assertion `type->is_pointer_or_reference ()' failed.
    
    The problem is that label symbols are created using the
    builtin_core_addr type, which is a pure integer type.
    
    When GDB tries to fetch the value of a label symbol then we end up in
    findvar.c, in the function language_defn::read_var_value, in the
    LOC_LABEL case.  From here store_typed_address is called to store the
    address of the label into a value object with builtin_core_addr type.
    
    The problem is that store_typed_address requires that the destination
    type be a pointer or reference, which the builtin_core_addr type is
    not.
    
    Now it's not clear what type a goto label address should have, but
    GCC has an extension that allows users to take the address of a goto
    label (using &&), in that case the result is of type 'void *'.
    
    I propose that when we convert the CORE_ADDR value to a GDB value
    object, we use builtin_func_ptr type instead of builtin_core_addr,
    this means the result will be of type 'void (*) ()'.  The benefit of
    this approach is that when gdbarch_address_to_pointer is called the
    target type will be correctly identified as a pointer to code, which
    should mean any architecture specific adjustments are done correctly.
    
    We can then cast the new value to 'void *' type with a call to
    value_cast_pointer, this should not change the values bit
    representation, but will just update the type.
    
    After this asking for the value of a label symbol works just fine:
    
      (gdb) python print(str(symbol.value()))
      0x401135 <main+35>
    
    And the type is maybe what we'd expect:
    
      (gdb) python print(str(symbol.value().type))
      void *

diff --git a/gdb/findvar.c b/gdb/findvar.c
index e609358df08..06fc9b7d5bd 100644
--- a/gdb/findvar.c
+++ b/gdb/findvar.c
@@ -593,20 +593,32 @@ language_defn::read_var_value (struct symbol *var,
       return v;
 
     case LOC_LABEL:
-      /* Put the constant back in target format.  */
-      v = allocate_value (type);
-      if (overlay_debugging)
-	{
-	  struct objfile *var_objfile = var->objfile ();
-	  addr = symbol_overlayed_address (var->value_address (),
-					   var->obj_section (var_objfile));
-	  store_typed_address (value_contents_raw (v).data (), type, addr);
-	}
-      else
-	store_typed_address (value_contents_raw (v).data (), type,
-			      var->value_address ());
-      VALUE_LVAL (v) = not_lval;
-      return v;
+      {
+	/* Put the constant back in target format.  */
+	if (overlay_debugging)
+	  {
+	    struct objfile *var_objfile = var->objfile ();
+	    addr = symbol_overlayed_address (var->value_address (),
+					     var->obj_section (var_objfile));
+	  }
+	else
+	  addr = var->value_address ();
+
+	/* First convert the CORE_ADDR to a function pointer type, this
+	   ensures the gdbarch knows what type of pointer we are
+	   manipulating when value_from_pointer is called.  */
+	type = builtin_type (var->arch ())->builtin_func_ptr;
+	v = value_from_pointer (type, addr);
+
+	/* But we want to present the value as 'void *', so cast it to the
+	   required type now, this will not change the values bit
+	   representation.  */
+	struct type *void_ptr_type
+	  = lookup_pointer_type (builtin_type (var->arch ())->builtin_void);
+	v = value_cast_pointers (void_ptr_type, v, 0);
+	VALUE_LVAL (v) = not_lval;
+	return v;
+      }
 
     case LOC_CONST_BYTES:
       if (is_dynamic_type (type))
diff --git a/gdb/testsuite/gdb.python/py-label-symbol-value.c b/gdb/testsuite/gdb.python/py-label-symbol-value.c
new file mode 100644
index 00000000000..94bdae6fd30
--- /dev/null
+++ b/gdb/testsuite/gdb.python/py-label-symbol-value.c
@@ -0,0 +1,38 @@
+/* This testcase is part of GDB, the GNU debugger.
+
+   Copyright 2022 Free Software Foundation, Inc.
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see  <http://www.gnu.org/licenses/>.  */
+
+volatile int global_var = 1;
+
+int
+get_value ()
+{
+  return global_var;
+}
+
+int
+main (void)
+{
+  int value = get_value ();
+  if (value > 0)
+    goto some_label;
+
+  return 1;
+
+ some_label:
+
+  return 0;
+}
diff --git a/gdb/testsuite/gdb.python/py-label-symbol-value.exp b/gdb/testsuite/gdb.python/py-label-symbol-value.exp
new file mode 100644
index 00000000000..44321e5f71d
--- /dev/null
+++ b/gdb/testsuite/gdb.python/py-label-symbol-value.exp
@@ -0,0 +1,39 @@
+# Copyright 2022 Free Software Foundation, Inc.
+
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# Check that GDB handles the user asking for the value of a label
+# symbol (i.e. a symbol for a goto label).
+
+load_lib gdb-python.exp
+standard_testfile
+
+if { [prepare_for_testing "failed to prepare" ${testfile} ${srcfile}] } {
+    return -1
+}
+
+# Skip all tests if Python scripting is not enabled.
+if { [skip_python_tests] } { continue }
+
+if ![runto_main] {
+   return -1
+}
+
+# Use Python to print the value of the 'some_label' symbol.
+gdb_test "python frame = gdb.selected_frame()"
+gdb_test "python frame_pc = frame.pc()"
+gdb_test "python block = gdb.current_progspace().block_for_pc(frame_pc)"
+gdb_test "python symbol,_ = gdb.lookup_symbol('some_label', block, gdb.SYMBOL_LABEL_DOMAIN)"
+gdb_test "python print(str(symbol.value()))" "$hex <main\\+$decimal>"
+gdb_test "python print(str(symbol.value().type))" "void \\*"

Re: [PATCH 2/2] gdb: fix crash when getting the value of a label symbol

[Tom Tromey]

Andrew> How about I just change to use 'void *' now?

Seems like a good idea to me.

Andrew> How's this?

I have one little nit.

Andrew> +	struct type *void_ptr_type
Andrew> +	  = lookup_pointer_type (builtin_type (var->arch ())->builtin_void);

I think this can use builtin_data_ptr.

Tom