From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <sourceware-bugzilla@sourceware.org>
Received: by sourceware.org (Postfix, from userid 48)
	id 0A8843858C56; Thu, 18 Jan 2024 16:44:47 +0000 (GMT)
DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 0A8843858C56
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sourceware.org;
	s=default; t=1705596288;
	bh=aDvnM0lF2NWB2CDZoLXSy2tCvBw6nL/lB6FrxBnPFBI=;
	h=From:To:Subject:Date:In-Reply-To:References:From;
	b=Nme0JEIsJeYyv2Vmoc6R1QhhBok1QWb/rbxiDB8vbgVY78BfFP7W9dH6DezZazE68
	 iDHPJN2rYEy2BtCXFhn0zHN4mnx624kD4DHSxrfGRoDj6vo5Vb5g4rsNCScNRbXsJQ
	 zt18u56EYeCdfdPFOVCHiri/iY17pG5TULMJlbUI=
From: "vries at gcc dot gnu.org" <sourceware-bugzilla@sourceware.org>
To: gdb-prs@sourceware.org
Subject: [Bug gdb/31258] [gdb] ThreadSanitizer: heap-use-after-free in
 memmove
Date: Thu, 18 Jan 2024 16:44:47 +0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gdb
X-Bugzilla-Component: gdb
X-Bugzilla-Version: HEAD
X-Bugzilla-Keywords: 
X-Bugzilla-Severity: normal
X-Bugzilla-Who: vries at gcc dot gnu.org
X-Bugzilla-Status: NEW
X-Bugzilla-Resolution: 
X-Bugzilla-Priority: P2
X-Bugzilla-Assigned-To: unassigned at sourceware dot org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags: 
X-Bugzilla-Changed-Fields: 
Message-ID: <bug-31258-4717-K7bBfR1CWi@http.sourceware.org/bugzilla/>
In-Reply-To: <bug-31258-4717@http.sourceware.org/bugzilla/>
References: <bug-31258-4717@http.sourceware.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: http://sourceware.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
List-Id: <gdb-prs.sourceware.org>

https://sourceware.org/bugzilla/show_bug.cgi?id=3D31258

--- Comment #2 from Tom de Vries <vries at gcc dot gnu.org> ---
The problem is a discrepancy between type size and fields.

The variable y2:
...
   Y2 : Variable_Record :=3D (A =3D> False, C =3D> 1.0, D =3D> 2);
...
is of type:
...
   type Variable_Record (A : Boolean :=3D True) is record
      case A is
         when True =3D>
            B : Integer;
         when False =3D>
            C : Float;
            D : Integer;
      end case;
   end record;
...

For the valid values of a, 0 and 1, we get correct values for the size of t=
he
type:
...
(gdb) set var y2.a=3D0
(gdb) ptype y2
type =3D struct parse__variable_record {
    boolean a;
    float c;
    integer d;
}
(gdb) p sizeof (y2)
$9 =3D 12
(gdb) set var y2.a=3D1
(gdb) ptype y2
type =3D struct parse__variable_record {
    boolean a;
    integer b;
}
(gdb) p sizeof (y2)
$10 =3D 8
....
and correct corresponding types.

When y2.a is unitialized, say to 0x70:
...
(gdb) set var y2.a=3D0x70
(gdb) ptype y2
type =3D struct parse__variable_record {
    boolean a;
    float c;
    integer d;
}
(gdb) p sizeof (y2)
$14 =3D 8
...
we get the type with three fields, which doesn't fit in the computed type s=
ize
of 8.

This demonstrator patch fixes it for ada:
...
diff --git a/gdb/ada-valprint.c b/gdb/ada-valprint.c
index ac85440b139..79769bae3bd 100644
--- a/gdb/ada-valprint.c
+++ b/gdb/ada-valprint.c
@@ -601,6 +601,10 @@ print_field_values (struct value *value, struct value
*outer_value,
          continue;
        }

+      long field_offset =3D type->field (i).loc_bitpos ();
+      if (field_offset / 8 >=3D type->length ())
+       continue;
+=20=20=20=20=20=20
       if (comma_needed)
        gdb_printf (stream, ", ");
       comma_needed =3D 1;
...

However, same issue triggers again when setting language to c.

--=20
You are receiving this mail because:
You are on the CC list for the bug.=