[Bug cli/28665] CLI commands that cause crash

["cvs-commit at gcc dot gnu.org" <sourceware-bugzilla@sourceware.org>]

https://sourceware.org/bugzilla/show_bug.cgi?id=28665

--- Comment #4 from cvs-commit at gcc dot gnu.org <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Andrew Burgess <aburgess@sourceware.org>:

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=8e454b9c61b6d3a80ea4bc840e808e1564d94ec7

commit 8e454b9c61b6d3a80ea4bc840e808e1564d94ec7
Author: Andrew Burgess <aburgess@redhat.com>
Date:   Tue Dec 7 13:25:47 2021 +0000

    gdb: add empty string check in parse_linespec

    If parse_linespec (linespec.c) is passed ARG as an empty string then
    we end up calling `strchr (linespec_quote_characters, '\0')`, which
    will return a pointer to the '\0' at the end of
    linespec_quote_characters.  This then results in GDB calling
    skip_quote_char with `ARG + 1`, which is undefined behaviour (as ARG
    only contained a single character, the '\0').

    Fix this by checking for the first character of ARG being '\0' before
    the call to strchr.

    I have additionally added an assertion that ARG can't itself be
    nullptr, as calling is_ada_operator with nullptr can end up calling
    'startswith' on the nullptr, which is undefined behaviour.

    Finally, I moved the declaration of TOKEN into the body of
    parse_linespec, to where TOKEN is defined.

    This patch came about while I was working on fixes for PR cli/28665
    and PR gdb/28797.  The actual fixes for these two issues will be in a
    later commit in this series, but, with this patch in place, both of
    the above bugs would hit the new assertion rather than accessing
    invalid memory and crashing.  The '\0' check is not currently ever
    hit, but just makes the code a little safer.

    Because this patch only changes the nature of the failure for the
    above two bugs, there's no tests here.  A later commit will fix the
    above two issues, at which point I'll add some tests.

    Bug: https://sourceware.org/bugzilla/show_bug.cgi?id=28665
    Bug: https://sourceware.org/bugzilla/show_bug.cgi?id=28797

-- 
You are receiving this mail because:
You are on the CC list for the bug.