[Bug gdb/26901] New: Python array subscript fails with flexible array member without size

["simark at simark dot ca" <sourceware-bugzilla@sourceware.org>]

https://sourceware.org/bugzilla/show_bug.cgi?id=26901

            Bug ID: 26901
           Summary: Python array subscript fails with flexible array
                    member without size
           Product: gdb
           Version: HEAD
            Status: NEW
          Severity: normal
          Priority: P2
         Component: gdb
          Assignee: unassigned at sourceware dot org
          Reporter: simark at simark dot ca
  Target Milestone: ---

Consider this program:

---
#include <stdlib.h>

struct vectorinox
{
  int size;
  int data[];
};

int main (void)
{
    /* Make a vector of three elements.  */
    struct vectorinox *vector = malloc (sizeof (struct vectorinox) +
sizeof(int) * 3);
    vector->size = 3;
    vector->data[0] = 11;
    vector->data[1] = 22;
    vector->data[2] = 33;

    return 0;
}
---

Trying to access an element of the `data` array in Python yields:

>>> vec = gdb.parse_and_eval('vector')
>>> data = vec['data']
>>> print(data[0])
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
gdb.MemoryError: Cannot access memory at address 0x5535555592a0

And with GDB 9.2:

>>> vec = gdb.parse_and_eval('vector')
>>> data = vec['data']
>>> print(data[0])
11

This failure was introduced by commit 7c6f27129631 ("gdb: make
get_discrete_bounds check for non-constant range bounds").  Unfortunately, this
commit doesn't build, but it's trivial to fix if you want to try it: just
remove the parenthesis after `kind` that it introduces.

val_subscript passes the array's index type (of type code TYPE_CODE_RANGE) to
get_discrete_bounds.  The index type has the low bound set to constant 0 and
the high bound unknown.  Before the commit, get_discrete_bounds would return
"success" and set the low and high bound to 0.  Although it's a bit by chance
that it returned 0 for the high bound, since the bound was "unknown".  It
doesn't really matter in that case because the high bound doesn't get used by
the caller.

After the commit, the new check in get_discrete_bounds sees that the high bound
isn't a constant, so returns "failure".  However, val_subscript doesn't check
the return value, and uses the uninitialized values of low and high bounds, and
it goes downhill from there.

-- 
You are receiving this mail because:
You are on the CC list for the bug.