[Bug gdb/31258] [gdb] ThreadSanitizer: heap-use-after-free in memmove

["vries at gcc dot gnu.org" <sourceware-bugzilla@sourceware.org>]

https://sourceware.org/bugzilla/show_bug.cgi?id=31258

--- Comment #2 from Tom de Vries <vries at gcc dot gnu.org> ---
The problem is a discrepancy between type size and fields.

The variable y2:
...
   Y2 : Variable_Record := (A => False, C => 1.0, D => 2);
...
is of type:
...
   type Variable_Record (A : Boolean := True) is record
      case A is
         when True =>
            B : Integer;
         when False =>
            C : Float;
            D : Integer;
      end case;
   end record;
...

For the valid values of a, 0 and 1, we get correct values for the size of the
type:
...
(gdb) set var y2.a=0
(gdb) ptype y2
type = struct parse__variable_record {
    boolean a;
    float c;
    integer d;
}
(gdb) p sizeof (y2)
$9 = 12
(gdb) set var y2.a=1
(gdb) ptype y2
type = struct parse__variable_record {
    boolean a;
    integer b;
}
(gdb) p sizeof (y2)
$10 = 8
....
and correct corresponding types.

When y2.a is unitialized, say to 0x70:
...
(gdb) set var y2.a=0x70
(gdb) ptype y2
type = struct parse__variable_record {
    boolean a;
    float c;
    integer d;
}
(gdb) p sizeof (y2)
$14 = 8
...
we get the type with three fields, which doesn't fit in the computed type size
of 8.

This demonstrator patch fixes it for ada:
...
diff --git a/gdb/ada-valprint.c b/gdb/ada-valprint.c
index ac85440b139..79769bae3bd 100644
--- a/gdb/ada-valprint.c
+++ b/gdb/ada-valprint.c
@@ -601,6 +601,10 @@ print_field_values (struct value *value, struct value
*outer_value,
          continue;
        }

+      long field_offset = type->field (i).loc_bitpos ();
+      if (field_offset / 8 >= type->length ())
+       continue;
+      
       if (comma_needed)
        gdb_printf (stream, ", ");
       comma_needed = 1;
...

However, same issue triggers again when setting language to c.

-- 
You are receiving this mail because:
You are on the CC list for the bug.