dwarf2-frame clobbers memory

dwarf2-frame clobbers memory

[Richard Henderson]

At the following traceback, memmove is overwriting the "help"
command, which results in a segv on the next command.  Is this
enough to track down the problem?

Target is alpha-linux.


r~


Watchpoint 4: *$16

Old value = 0x1202a70ff "help"
New value = 0x0
0x00000200001d7e0c in memmove () from /lib/libc.so.6.1
(top-gdb) where
#0  0x00000200001d7e0c in memmove () from /lib/libc.so.6.1
#1  0x00000001201e1a64 in execute_cfa_program (
    insn_ptr=0x1204359d0 " Ï< \001",
    insn_end=0x10000001b <Address 0x10000001b out of bounds>, next_frame=0x18,
    fs=0x2) at ../../../src-binu/gdb/dwarf2-frame.c:298
#2  0x00000001201e1a64 in execute_cfa_program (
    insn_ptr=0x1203ff670 "D\f\017\020", insn_end=0x1203ff678 "",
    next_frame=0x1203ba450, fs=0x1204359d0)
    at ../../../src-binu/gdb/dwarf2-frame.c:298
#3  0x00000001201e25ac in dwarf2_frame_cache (next_frame=0x1203ba450,
    this_cache=0x1203ba508) at ../../../src-binu/gdb/dwarf2-frame.c:518
#4  0x00000001201e2838 in dwarf2_frame_this_id (next_frame=0x1203ba450,
    this_cache=0x1203ba508, this_id=0x1203ba540)
    at ../../../src-binu/gdb/dwarf2-frame.c:567
#5  0x0000000120162928 in get_frame_id (fi=0x1203ba4e8)
    at ../../../src-binu/gdb/frame.c:243
#6  0x0000000120162db4 in frame_find_by_id (id=
      {stack_addr = 4831835808, code_addr = 4831839664})
    at ../../../src-binu/gdb/frame.c:349
#7  0x00000001200be258 in restore_selected_frame (args=0x120468ec0)
    at ../../../src-binu/gdb/infrun.c:3623
#8  0x00000001201567fc in do_catch_errors (uiout=0x1203c40b0, data=0x11fffe280)
    at ../../../src-binu/gdb/top.c:492
#9  0x0000000120156598 in catcher (func=0x1201567c0 <do_catch_errors>,
    func_uiout=0x1203c40b0, func_args=0x11fffe280, func_val=0x11fffe274,
    func_caught=0x11fffe278,
    errstring=0x1202ba8a3 "Unable to restore previously selected frame:\n",
    mask=2) at ../../../src-binu/gdb/top.c:424
#10 0x0000000120156888 in catch_errors (
    func=0x1200be220 <restore_selected_frame>, func_args=0x120468ec0,
    errstring=0x1202ba8a3 "Unable to restore previously selected frame:\n",
    mask=2) at ../../../src-binu/gdb/top.c:504
#11 0x00000001200be490 in restore_inferior_status (inf_status=0x120468e50)
    at ../../../src-binu/gdb/infrun.c:3681
#12 0x00000001200be50c in do_restore_inferior_status_cleanup (sts=0x120468e50)
    at ../../../src-binu/gdb/infrun.c:3697
#13 0x000000012015adc0 in do_my_cleanups (pmy_chain=0x120373d10,
    old_chain=0x12041b380) at ../../../src-binu/gdb/utils.c:323
#14 0x000000012015ac10 in do_cleanups (old_chain=0x0)
    at ../../../src-binu/gdb/utils.c:288
#15 0x00000001200b2e6c in call_function_by_hand (function=0x120495670,
    nargs=2, args=0x11fffe4f8) at ../../../src-binu/gdb/infcall.c:1006
#16 0x000000012007b418 in evaluate_subexp_standard (expect_type=0x0,
    exp=0x120468b00, pos=0x11fffe8b8, noside=EVAL_NORMAL)
    at ../../../src-binu/gdb/eval.c:1221
#17 0x000000012007793c in evaluate_subexp (expect_type=0x0, exp=0x1203cf3a0,
    pos=0x1c, noside=EVAL_NORMAL) at ../../../src-binu/gdb/eval.c:73
#18 0x0000000120077d1c in evaluate_expression (exp=0x120468b00)
    at ../../../src-binu/gdb/eval.c:162

Re: dwarf2-frame clobbers memory

[Richard Henderson]

On Sat, May 31, 2003 at 08:36:21PM -0700, Richard Henderson wrote:
> At the following traceback, memmove is overwriting the "help"
> command, which results in a segv on the next command.  Is this
> enough to track down the problem?

Nevermind, found it.  Let us remember how pointer arithmetic works.  ;-)


r~


	* dwarf2-frame.c (dwarf2_frame_state_alloc_regs): Fix ptr arithmetic.

Index: dwarf2-frame.c
===================================================================
RCS file: /cvs/src/src/gdb/dwarf2-frame.c,v
retrieving revision 1.1
diff -c -p -d -r1.1 dwarf2-frame.c
*** dwarf2-frame.c	31 May 2003 19:18:05 -0000	1.1
--- dwarf2-frame.c	1 Jun 2003 07:45:41 -0000
*************** dwarf2_frame_state_alloc_regs (struct dw
*** 163,169 ****
      xrealloc (rs->reg, num_regs * size);
  
    /* Initialize newly allocated registers.  */
!   memset (rs->reg + rs->num_regs * size, 0, (num_regs - rs->num_regs) * size);
    rs->num_regs = num_regs;
  }
  
--- 166,172 ----
      xrealloc (rs->reg, num_regs * size);
  
    /* Initialize newly allocated registers.  */
!   memset (rs->reg + rs->num_regs, 0, (num_regs - rs->num_regs) * size);
    rs->num_regs = num_regs;
  }
  

Re: dwarf2-frame clobbers memory

[Mark Kettenis]

   Date: Sun, 1 Jun 2003 00:47:33 -0700
   From: Richard Henderson <rth@redhat.com>

   On Sat, May 31, 2003 at 08:36:21PM -0700, Richard Henderson wrote:
   > At the following traceback, memmove is overwriting the "help"
   > command, which results in a segv on the next command.  Is this
   > enough to track down the problem?

   Nevermind, found it.  Let us remember how pointer arithmetic works.  ;-)

Thanks!  I went ahead and committed this.

Mark