From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 3825 invoked by alias); 3 Oct 2009 03:16:43 -0000 Received: (qmail 3809 invoked by uid 48); 3 Oct 2009 03:16:42 -0000 Date: Sat, 03 Oct 2009 03:16:00 -0000 From: "snyder at bnl dot gov" To: gdb-prs@sourceware.org Message-ID: <20091003031641.10728.snyder@bnl.gov> Reply-To: sourceware-bugzilla@sourceware.org Subject: [Bug exp/10728] New: gdb 7.0 branch: infinite loop evaluating pointer difference w/o complete debug info X-Bugzilla-Reason: CC Mailing-List: contact gdb-prs-help@sourceware.org; run by ezmlm Precedence: bulk List-Id: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: gdb-prs-owner@sourceware.org X-SW-Source: 2009-q4/txt/msg00019.txt.bz2 hi - Running gdb from the head of the gdb_7_0-branch, i found that trying to evaluate the difference between two pointers for which complete debugging information is not available causes gdb to go into an infinite loop. Here's an example of how to reproduce this problem. This was done using gcc 4.1.2 on a Scientific Linux 5.3 system. Here are the sources: -- x.h ------------------------------------- struct Y; struct X { Y* y1; Y* y2; }; X* y(); -- x.cc ------------------------------------ #include "x.h" int main() { X* x = y(); return 0; } -- y.cc ------------------------------------ #include "x.h" struct Y{}; X* y() { static X xx; static Y yy; xx.y1 = &yy; xx.y2 = xx.y1+1; return &xx; } -------------------------------------------- Build like this: $ g++ -c y.cc $ g++ -g -o x x.cc y.o Then run under the debugger: $ .../gdb ./x ... GNU gdb (GDB) 6.8.92.20091003-cvs ... This GDB was configured as "x86_64-unknown-linux-gnu". ... (gdb) break main Breakpoint 1 at 0x400530: file x.cc, line 5. (gdb) run Starting program: /direct/usatlas+u/snyder/x Breakpoint 1, main () at x.cc:5 5 X* x = y(); (gdb) n 6 return 0; (gdb) p *x $1 = {y1 = 0x600990, y2 = 0x600991} (gdb) p x->y2-x->y1 At which point gdb goes into an infinite loop. Attaching to the looping gdb gives this stack trace: 0x0000000000510fc4 in value_ptrdiff (arg1=0x7ba1840, arg2=0x7ba1a70) at valarith.c:125 125 return (value_as_long (arg1) - value_as_long (arg2)) / sz; (gdb) bt #0 0x0000000000510fc4 in value_ptrdiff (arg1=0x7ba1840, arg2=0x7ba1a70) at valarith.c:125 #1 0x000000000050793a in evaluate_subexp_standard (expect_type=0x0, exp=0x7ba13a0, pos=0x7fff779a07fc, noside=EVAL_NORMAL) at eval.c:1802 #2 0x00000000005caa0f in evaluate_subexp_c (expect_type=0x0, exp=0x7ba13a0, pos=0x7fff779a07fc, noside=EVAL_NORMAL) at c-lang.c:1038 #3 0x0000000000502cc7 in evaluate_subexp (expect_type=0x0, exp=0x7ba13a0, pos=0x7fff779a07fc, noside=EVAL_NORMAL) at eval.c:73 #4 0x0000000000502e82 in evaluate_expression (exp=0x7ba13a0) at eval.c:163 #5 0x0000000000517fd9 in print_command_1 (exp=0x7a35102 "x->y2-x->y1", inspect=0, voidprint=1) at ./printcmd.c:898 #6 0x0000000000518158 in print_command (exp=0x7a35102 "x->y2-x->y1", from_tty=1) at ./printcmd.c:946 #7 0x00000000004aef74 in do_cfunc (c=0x7a6ff20, args=0x7a35102 "x->y2-x->y1", from_tty=1) at ./cli/cli-decode.c:67 #8 0x00000000004b1e71 in cmd_func (cmd=0x7a6ff20, args=0x7a35102 "x->y2-x->y1", from_tty=1) at ./cli/cli-decode.c:1738 ... In the expression here, sz is 0: (gdb) p sz $1 = 0 Trying to continue gives: (gdb) c Continuing. Program received signal SIGFPE, Arithmetic exception. 0x0000000000510fc4 in value_ptrdiff (arg1=0x7ba1840, arg2=0x7ba1a70) at valarith.c:125 125 return (value_as_long (arg1) - value_as_long (arg2)) / sz; So we're endlessly trying to divide by zero. I made this patch to protect against this. 2009-10-02 scott s snyder * valarith.c (value_ptrdiff): sz can be zero if the target type of the pointer is not complete. Protect against division by zero, which will cause an infinite loop. Index: valarith.c =================================================================== RCS file: /cvs/src/src/gdb/valarith.c,v retrieving revision 1.76 diff -u -p -r1.76 valarith.c --- valarith.c 2 Jul 2009 17:25:59 -0000 1.76 +++ valarith.c 3 Oct 2009 02:59:13 -0000 @@ -122,6 +122,10 @@ First argument of `-' is a pointer and s an integer nor a pointer of the same type.")); sz = TYPE_LENGTH (check_typedef (TYPE_TARGET_TYPE (type1))); + if (sz == 0) { + error (_("Cannot perform pointer math on incomplete types, " + "try casting to a known type, or void *.")); + } return (value_as_long (arg1) - value_as_long (arg2)) / sz; } -- Summary: gdb 7.0 branch: infinite loop evaluating pointer difference w/o complete debug info Product: gdb Version: 6.8 Status: UNCONFIRMED Severity: normal Priority: P2 Component: exp AssignedTo: unassigned at sourceware dot org ReportedBy: snyder at bnl dot gov CC: gdb-prs at sourceware dot org GCC build triplet: x86_64-unknown-linux-gnu GCC host triplet: x86_64-unknown-linux-gnu GCC target triplet: x86_64-unknown-linux-gnu http://sourceware.org/bugzilla/show_bug.cgi?id=10728 ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.