From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 18390 invoked by alias); 8 Mar 2012 13:16:11 -0000 Received: (qmail 18372 invoked by uid 22791); 8 Mar 2012 13:16:10 -0000 X-SWARE-Spam-Status: No, hits=-2.1 required=5.0 tests=AWL,BAYES_00,TW_EG,T_RP_MATCHES_RCVD X-Spam-Check-By: sourceware.org Received: from mail.allinea.com (HELO mail.allinea.com) (94.125.131.200) by sourceware.org (qpsmtpd/0.43rc1) with ESMTP; Thu, 08 Mar 2012 13:15:49 +0000 Received: from localhost (localhost [127.0.0.1]) by mail.allinea.com (Postfix) with ESMTP id 1462E12FBFE for ; Thu, 8 Mar 2012 13:15:48 +0000 (GMT) Received: from mail.allinea.com ([127.0.0.1]) by localhost (mail.allinea.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PQnwkNFvV0Rs for ; Thu, 8 Mar 2012 13:15:47 +0000 (GMT) Received: from [192.168.0.6] (cpc11-sotn9-2-0-cust158.15-1.cable.virginmedia.com [81.101.103.159]) (Authenticated sender: cjanuary) by mail.allinea.com (Postfix) with ESMTPSA id B669D12FBFC for ; Thu, 8 Mar 2012 13:15:47 +0000 (GMT) Message-ID: <1331212547.2742.4.camel@gumtree> Subject: [PATCH] AIX: Fix buffer overflow in fill_fprs From: Chris January To: gdb-patches@sourceware.org Date: Thu, 08 Mar 2012 13:16:00 -0000 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: 7bit Mime-Version: 1.0 X-IsSubscribed: yes Mailing-List: contact gdb-patches-help@sourceware.org; run by ezmlm Precedence: bulk List-Id: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: gdb-patches-owner@sourceware.org X-SW-Source: 2012-03/txt/msg00260.txt.bz2 The callers of fill_fprs expect the first floating point register to be written to vals[0], but it's currently written to vals[tdep->ppc_fp0_regnum] which can cause GDB to segfault as the caller's buffer overflows. 2012-03-08 Chris January * aix-thread.c (fill_sprs): Store the floating point registers at the correct offsets into vals. --- diff --git a/gdb/aix-thread.c b/gdb/aix-thread.c index 0a9fae3..0c697f7 100644 --- a/gdb/aix-thread.c +++ b/gdb/aix-thread.c @@ -1356,7 +1356,8 @@ fill_fprs (const struct regcache *regcache, double *vals) regno < tdep->ppc_fp0_regnum + ppc_num_fprs; regno++) if (REG_VALID == regcache_register_status (regcache, regno)) - regcache_raw_collect (regcache, regno, vals + regno); + regcache_raw_collect (regcache, regno, + vals + regno - tdep->ppc_fp0_regnum); } /* Store the special registers into the specified 64-bit and 32-bit