From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 28173 invoked by alias); 28 Apr 2008 08:38:00 -0000 Received: (qmail 28164 invoked by uid 22791); 28 Apr 2008 08:37:59 -0000 X-Spam-Check-By: sourceware.org Received: from host0.dyn.jankratochvil.net (HELO host0.dyn.jankratochvil.net) (89.250.240.59) by sourceware.org (qpsmtpd/0.31) with ESMTP; Mon, 28 Apr 2008 08:37:36 +0000 Received: from host0.dyn.jankratochvil.net (localhost [127.0.0.1]) by host0.dyn.jankratochvil.net (8.14.2/8.14.1) with ESMTP id m3S8bWkc012663 for ; Mon, 28 Apr 2008 10:37:32 +0200 Received: (from jkratoch@localhost) by host0.dyn.jankratochvil.net (8.14.2/8.14.2/Submit) id m3S8bW3l012662 for gdb-patches@sourceware.org; Mon, 28 Apr 2008 10:37:32 +0200 Date: Mon, 28 Apr 2008 14:44:00 -0000 From: Jan Kratochvil To: gdb-patches@sourceware.org Subject: [patch] 2/3: Fix crash on self-looping DW_OP_fbreg Message-ID: <20080428083732.GB12394@host0.dyn.jankratochvil.net> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="qlTNgmc+xy1dBmNv" Content-Disposition: inline User-Agent: Mutt/1.5.17 (2007-11-01) X-IsSubscribed: yes Mailing-List: contact gdb-patches-help@sourceware.org; run by ezmlm Precedence: bulk List-Id: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: gdb-patches-owner@sourceware.org X-SW-Source: 2008-04/txt/msg00633.txt.bz2 --qlTNgmc+xy1dBmNv Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-length: 457 Hi, I saw there GDB will naively loop and crash on DW_OP_fbreg contained in the location list of DW_AT_frame_base. I am not aware of an existing case using such broken debug info. dwarf_expr_context->recursion_depth and dwarf_expr_context->max_recursion_depth are declared but never used in the GDB sources. IMO MAX_RECURSION_DEPTH could be a constant but I left the code according to the existing declaration. No regressions on x86_64. Regards, Jan --qlTNgmc+xy1dBmNv Content-Type: text/plain; charset=us-ascii Content-Disposition: inline; filename="gdb-fbreg-loop.patch" Content-length: 3193 2008-04-28 Jan Kratochvil * Makefile.in: Update dependencies. * dwarf2expr.c: New include "gdb_assert.h". (new_dwarf_expr_context): Initialize MAX_RECURSION_DEPTH. (struct dwarf_expr_eval_cleanup, dwarf_expr_eval_cleanup): New. (dwarf_expr_eval): Protect the RECURSION_DEPTH count for exceptions. (execute_stack_op): Error out on too large RECURSION_DEPTH. Increase/decrease RECURSION_DEPTH around the function. --- ./gdb/Makefile.in 24 Apr 2008 10:21:44 -0000 1.1004 +++ ./gdb/Makefile.in 28 Apr 2008 00:26:38 -0000 @@ -2077,7 +2077,7 @@ dummy-frame.o: dummy-frame.c $(defs_h) $ dfp.o: dfp.c $(defs_h) $(expression_h) $(gdbtypes_h) $(value_h) $(dfp_h) \ $(decimal128_h) $(decimal64_h) $(decimal32_h) dwarf2expr.o: dwarf2expr.c $(defs_h) $(symtab_h) $(gdbtypes_h) $(value_h) \ - $(gdbcore_h) $(elf_dwarf2_h) $(dwarf2expr_h) + $(gdbcore_h) $(elf_dwarf2_h) $(dwarf2expr_h) $(gdb_assert_h) dwarf2-frame.o: dwarf2-frame.c $(defs_h) $(dwarf2expr_h) $(elf_dwarf2_h) \ $(frame_h) $(frame_base_h) $(frame_unwind_h) $(gdbcore_h) \ $(gdbtypes_h) $(symtab_h) $(objfiles_h) $(regcache_h) \ --- ./gdb/dwarf2expr.c 18 Mar 2008 19:40:47 -0000 1.25 +++ ./gdb/dwarf2expr.c 28 Apr 2008 00:26:50 -0000 @@ -27,6 +27,7 @@ #include "gdbcore.h" #include "elf/dwarf2.h" #include "dwarf2expr.h" +#include "gdb_assert.h" /* Local prototypes. */ @@ -46,6 +47,7 @@ new_dwarf_expr_context (void) retval->stack = xmalloc (retval->stack_allocated * sizeof (CORE_ADDR)); retval->num_pieces = 0; retval->pieces = 0; + retval->max_recursion_depth = 0x100; return retval; } @@ -131,10 +133,35 @@ add_piece (struct dwarf_expr_context *ct /* Evaluate the expression at ADDR (LEN bytes long) using the context CTX. */ +struct dwarf_expr_eval_cleanup + { + struct dwarf_expr_context *ctx; + int old_recursion_depth; + }; + +static void +dwarf_expr_eval_cleanup (void *data_voidp) +{ + struct dwarf_expr_eval_cleanup *data = data_voidp; + + data->ctx->recursion_depth = data->old_recursion_depth; +} + void dwarf_expr_eval (struct dwarf_expr_context *ctx, gdb_byte *addr, size_t len) { + struct cleanup *back_to; + struct dwarf_expr_eval_cleanup data; + + data.ctx = ctx; + data.old_recursion_depth = ctx->recursion_depth; + back_to = make_cleanup (dwarf_expr_eval_cleanup, &data); + execute_stack_op (ctx, addr, addr + len); + + gdb_assert (ctx->recursion_depth == data.old_recursion_depth); + /* It would be a NOP. */ + discard_cleanups (back_to); } /* Decode the unsigned LEB128 constant at BUF into the variable pointed to @@ -281,6 +308,11 @@ execute_stack_op (struct dwarf_expr_cont ctx->in_reg = 0; ctx->initialized = 1; /* Default is initialized. */ + if (ctx->recursion_depth > ctx->max_recursion_depth) + error (_("DWARF-2 expression error: Loop detected (%d)."), + ctx->recursion_depth); + ctx->recursion_depth++; + while (op_ptr < op_end) { enum dwarf_location_atom op = *op_ptr++; @@ -739,4 +771,7 @@ execute_stack_op (struct dwarf_expr_cont dwarf_expr_push (ctx, result); no_push:; } + + ctx->recursion_depth--; + gdb_assert (ctx->recursion_depth >= 0); } --qlTNgmc+xy1dBmNv--