From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <gdb-prs-return-17085-listarch-gdb-prs=sources.redhat.com@sourceware.org>
Received: (qmail 22778 invoked by alias); 1 Dec 2014 21:07:07 -0000
Mailing-List: contact gdb-prs-help@sourceware.org; run by ezmlm
Precedence: bulk
List-Id: <gdb-prs.sourceware.org>
List-Subscribe: <mailto:gdb-prs-subscribe@sourceware.org>
List-Archive: <http://sourceware.org/ml/gdb-prs/>
List-Post: <mailto:gdb-prs@sourceware.org>
List-Help: <mailto:gdb-prs-help@sourceware.org>, <http://sourceware.org/lists.html#faqs>
Sender: gdb-prs-owner@sourceware.org
Received: (qmail 22747 invoked by uid 48); 1 Dec 2014 21:07:05 -0000
From: "larue at cadence dot com" <sourceware-bugzilla@sourceware.org>
To: gdb-prs@sourceware.org
Subject: [Bug gdb/9885] field for register names too narrow
Date: Mon, 01 Dec 2014 21:07:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gdb
X-Bugzilla-Component: gdb
X-Bugzilla-Version: 6.8
X-Bugzilla-Keywords: 
X-Bugzilla-Severity: enhancement
X-Bugzilla-Who: larue at cadence dot com
X-Bugzilla-Status: UNCONFIRMED
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: unassigned at sourceware dot org
X-Bugzilla-Target-Milestone: 6.8
X-Bugzilla-Flags:
X-Bugzilla-Changed-Fields: 
Message-ID: <bug-9885-4717-6K1I8xdKTM@http.sourceware.org/bugzilla/>
In-Reply-To: <bug-9885-4717@http.sourceware.org/bugzilla/>
References: <bug-9885-4717@http.sourceware.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
X-Bugzilla-URL: http://sourceware.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-SW-Source: 2014-q4/txt/msg00328.txt.bz2

https://sourceware.org/bugzilla/show_bug.cgi?id=9885

--- Comment #1 from larue at cadence dot com ---
I have recently encountered this problem, and found it is much more severe than
indicated in this bug report.  If a register name is > 15 characters then a
negative value is passed to n_spaces().  This causes garbage to be printed, and
occasional crashes of gdb.

This problem still exists in gdb-7.8.1.

The function default_print_one_register_info() calls:
print_spaces_filtered (15 - strlen (name), file);

if the register length is greater than 15, then print_spaces_filtered is called
with a negative value.

The following is a snippet of code from gdb/utils.c.  Notice that if n < 0,
then n_spaces returns pointer to potentially unallocated data in the heap.
This sometimes causes a crash in gdb, and garbage is printed in other cases.

char *
n_spaces (int n)
{
  char *t;
  static char *spaces = 0;
  static int max_spaces = -1;

  if (n > max_spaces)
    {
      if (spaces)
        xfree (spaces);
      spaces = (char *) xmalloc (n + 1);
      for (t = spaces + n; t != spaces;)
        *--t = ' ';
      spaces[n] = '\0';
      max_spaces = n;
    }

  return spaces + max_spaces - n;
}

void
print_spaces_filtered (int n, struct ui_file *stream)
{
  fputs_filtered (n_spaces (n), stream);
}


Ideally, gdb should be able to nicely print with arbitrary length register
names, but at a minimum the crash and garbage output should be fixed. A simple
way to do this is to put this check in n_spaces()

char *
n_spaces (int n)
{
  char *t;
  static char *spaces = 0;
  static int max_spaces = -1;

  if (n > max_spaces)
    {
      if (spaces)
        xfree (spaces);
      spaces = (char *) xmalloc (n + 1);
      for (t = spaces + n; t != spaces;)
        *--t = ' ';
      spaces[n] = '\0';
      max_spaces = n;
    }

  return spaces + max_spaces - n;
}

-- 
You are receiving this mail because:
You are on the CC list for the bug.