* [RFA] off by one array reference in i386-low.c/i386_show_dr
@ 2011-02-26 23:24 Michael Snyder
2011-02-27 16:47 ` Jan Kratochvil
2011-02-27 17:01 ` Pedro Alves
0 siblings, 2 replies; 7+ messages in thread
From: Michael Snyder @ 2011-02-26 23:24 UTC (permalink / raw)
To: gdb-patches, Doug Evans
[-- Attachment #1: Type: text/plain, Size: 154 bytes --]
Doug,
I'm not 100 percent sure this is right, but I do know that
as written, it will overflow the array dr_mirror. What do
you think?
Thanks,
Michael
[-- Attachment #2: offbyone2.txt --]
[-- Type: text/plain, Size: 752 bytes --]
2011-02-26 Michael Snyder <msnyder@vmware.com>
* i386-low.c (i386_show_dr): Fix off-by-one array reference.
Index: i386-low.c
===================================================================
RCS file: /cvs/src/src/gdb/gdbserver/i386-low.c,v
retrieving revision 1.5
diff -u -p -u -p -r1.5 i386-low.c
--- i386-low.c 1 Jan 2011 15:33:24 -0000 1.5
+++ i386-low.c 26 Feb 2011 22:48:38 -0000
@@ -195,7 +195,7 @@ i386_show_dr (struct i386_debug_reg_stat
\tDR%d: addr=0x%s, ref.count=%d DR%d: addr=0x%s, ref.count=%d\n",
i, paddress (state->dr_mirror[i]),
state->dr_ref_count[i],
- i + 1, paddress (state->dr_mirror[i + 1]),
+ i + 1, paddress (state->dr_mirror[i]),
state->dr_ref_count[i + 1]);
i++;
}
^ permalink raw reply [flat|nested] 7+ messages in thread* Re: [RFA] off by one array reference in i386-low.c/i386_show_dr
2011-02-26 23:24 [RFA] off by one array reference in i386-low.c/i386_show_dr Michael Snyder
@ 2011-02-27 16:47 ` Jan Kratochvil
2011-02-27 21:33 ` Michael Snyder
2011-02-27 17:01 ` Pedro Alves
1 sibling, 1 reply; 7+ messages in thread
From: Jan Kratochvil @ 2011-02-27 16:47 UTC (permalink / raw)
To: Michael Snyder; +Cc: gdb-patches, Doug Evans
Hi Michael,
On Sat, 26 Feb 2011 23:52:23 +0100, Michael Snyder wrote:
> I'm not 100 percent sure this is right, but I do know that
> as written, it will overflow the array dr_mirror. What do
> you think?
[...]
> --- i386-low.c 1 Jan 2011 15:33:24 -0000 1.5
> +++ i386-low.c 26 Feb 2011 22:48:38 -0000
/* A macro to loop over all debug registers. */
#define ALL_DEBUG_REGISTERS(i) for (i = 0; i < DR_NADDR; i++)
> @@ -195,7 +195,7 @@ i386_show_dr (struct i386_debug_reg_stat
ALL_DEBUG_REGISTERS(i)
{
printf_unfiltered ("\
> \tDR%d: addr=0x%s, ref.count=%d DR%d: addr=0x%s, ref.count=%d\n",
> i, paddress (state->dr_mirror[i]),
> state->dr_ref_count[i],
> - i + 1, paddress (state->dr_mirror[i + 1]),
> + i + 1, paddress (state->dr_mirror[i]),
> state->dr_ref_count[i + 1]);
> i++;
> }
->
CONTROL (DR7): 0000000000090101 STATUS (DR6): 0000000000004000
DR0: addr=0x0000000001c31f30, ref.count=1 DR1: addr=0x0000000000000000, ref.count=0
DR2: addr=0x0000000000000000, ref.count=0 DR3: addr=0x0000000000000000, ref.count=0
I do not see a bug there; still it could be better commented.
Thanks,
Jan
^ permalink raw reply [flat|nested] 7+ messages in thread* Re: [RFA] off by one array reference in i386-low.c/i386_show_dr
2011-02-27 16:47 ` Jan Kratochvil
@ 2011-02-27 21:33 ` Michael Snyder
2011-02-27 21:41 ` Jan Kratochvil
2011-02-27 21:50 ` Mark Kettenis
0 siblings, 2 replies; 7+ messages in thread
From: Michael Snyder @ 2011-02-27 21:33 UTC (permalink / raw)
To: Jan Kratochvil; +Cc: gdb-patches, Doug Evans
Jan Kratochvil wrote:
> Hi Michael,
>
> On Sat, 26 Feb 2011 23:52:23 +0100, Michael Snyder wrote:
>> I'm not 100 percent sure this is right, but I do know that
>> as written, it will overflow the array dr_mirror. What do
>> you think?
> [...]
>> --- i386-low.c 1 Jan 2011 15:33:24 -0000 1.5
>> +++ i386-low.c 26 Feb 2011 22:48:38 -0000
> /* A macro to loop over all debug registers. */
> #define ALL_DEBUG_REGISTERS(i) for (i = 0; i < DR_NADDR; i++)
>> @@ -195,7 +195,7 @@ i386_show_dr (struct i386_debug_reg_stat
> ALL_DEBUG_REGISTERS(i)
> {
> printf_unfiltered ("\
>> \tDR%d: addr=0x%s, ref.count=%d DR%d: addr=0x%s, ref.count=%d\n",
>> i, paddress (state->dr_mirror[i]),
>> state->dr_ref_count[i],
>> - i + 1, paddress (state->dr_mirror[i + 1]),
>> + i + 1, paddress (state->dr_mirror[i]),
>> state->dr_ref_count[i + 1]);
>> i++;
>> }
>
> ->
> CONTROL (DR7): 0000000000090101 STATUS (DR6): 0000000000004000
> DR0: addr=0x0000000001c31f30, ref.count=1 DR1: addr=0x0000000000000000, ref.count=0
> DR2: addr=0x0000000000000000, ref.count=0 DR3: addr=0x0000000000000000, ref.count=0
>
> I do not see a bug there; still it could be better commented.
The bug is that when "i" is 3, "i + 1" is 4, and the array only runs
from 0 to 3.
^ permalink raw reply [flat|nested] 7+ messages in thread* Re: [RFA] off by one array reference in i386-low.c/i386_show_dr
2011-02-27 21:33 ` Michael Snyder
@ 2011-02-27 21:41 ` Jan Kratochvil
2011-02-27 21:50 ` Mark Kettenis
1 sibling, 0 replies; 7+ messages in thread
From: Jan Kratochvil @ 2011-02-27 21:41 UTC (permalink / raw)
To: Michael Snyder; +Cc: gdb-patches, Doug Evans
On Sun, 27 Feb 2011 22:27:31 +0100, Michael Snyder wrote:
> Jan Kratochvil wrote:
> >Hi Michael,
> >On Sat, 26 Feb 2011 23:52:23 +0100, Michael Snyder wrote:
> >>--- i386-low.c 1 Jan 2011 15:33:24 -0000 1.5
> >>+++ i386-low.c 26 Feb 2011 22:48:38 -0000
> >/* A macro to loop over all debug registers. */
> >#define ALL_DEBUG_REGISTERS(i) for (i = 0; i < DR_NADDR; i++)
> >>@@ -195,7 +195,7 @@ i386_show_dr (struct i386_debug_reg_stat
> > ALL_DEBUG_REGISTERS(i)
> > {
> > printf_unfiltered ("\
> >> \tDR%d: addr=0x%s, ref.count=%d DR%d: addr=0x%s, ref.count=%d\n",
> >> i, paddress (state->dr_mirror[i]),
> >> state->dr_ref_count[i],
> >>- i + 1, paddress (state->dr_mirror[i + 1]),
> >>+ i + 1, paddress (state->dr_mirror[i]),
> >> state->dr_ref_count[i + 1]);
> >> i++;
> >> }
> >
> >->
> > CONTROL (DR7): 0000000000090101 STATUS (DR6): 0000000000004000
> > DR0: addr=0x0000000001c31f30, ref.count=1 DR1: addr=0x0000000000000000, ref.count=0
> > DR2: addr=0x0000000000000000, ref.count=0 DR3: addr=0x0000000000000000, ref.count=0
> >
> >I do not see a bug there; still it could be better commented.
>
> The bug is that when "i" is 3, "i + 1" is 4, and the array only runs
> from 0 to 3.
But "i" is never 3. "i" is 0 during the first cycle and 2 during the second
cycle. And then the for cycle ends. There is no 1 and there is no 3.
Regards,
Jan
^ permalink raw reply [flat|nested] 7+ messages in thread* Re: [RFA] off by one array reference in i386-low.c/i386_show_dr
2011-02-27 21:33 ` Michael Snyder
2011-02-27 21:41 ` Jan Kratochvil
@ 2011-02-27 21:50 ` Mark Kettenis
2011-02-27 22:05 ` Michael Snyder
1 sibling, 1 reply; 7+ messages in thread
From: Mark Kettenis @ 2011-02-27 21:50 UTC (permalink / raw)
To: msnyder; +Cc: jan.kratochvil, gdb-patches, dje
> Date: Sun, 27 Feb 2011 13:27:31 -0800
> From: Michael Snyder <msnyder@vmware.com>
>
> >> --- i386-low.c 1 Jan 2011 15:33:24 -0000 1.5
> >> +++ i386-low.c 26 Feb 2011 22:48:38 -0000
> > /* A macro to loop over all debug registers. */
> > #define ALL_DEBUG_REGISTERS(i) for (i = 0; i < DR_NADDR; i++)
> >> @@ -195,7 +195,7 @@ i386_show_dr (struct i386_debug_reg_stat
> > ALL_DEBUG_REGISTERS(i)
> > {
> > printf_unfiltered ("\
> >> \tDR%d: addr=0x%s, ref.count=%d DR%d: addr=0x%s, ref.count=%d\n",
> >> i, paddress (state->dr_mirror[i]),
> >> state->dr_ref_count[i],
> >> - i + 1, paddress (state->dr_mirror[i + 1]),
> >> + i + 1, paddress (state->dr_mirror[i]),
> >> state->dr_ref_count[i + 1]);
> >> i++;
> >> }
> >
> > ->
> > CONTROL (DR7): 0000000000090101 STATUS (DR6): 0000000000004000
> > DR0: addr=0x0000000001c31f30, ref.count=1 DR1: addr=0x0000000000000000, ref.count=0
> > DR2: addr=0x0000000000000000, ref.count=0 DR3: addr=0x0000000000000000, ref.count=0
> >
> > I do not see a bug there; still it could be better commented.
>
> The bug is that when "i" is 3, "i + 1" is 4, and the array only runs
> from 0 to 3.
But i can't be 3.
^ permalink raw reply [flat|nested] 7+ messages in thread* Re: [RFA] off by one array reference in i386-low.c/i386_show_dr
2011-02-27 21:50 ` Mark Kettenis
@ 2011-02-27 22:05 ` Michael Snyder
0 siblings, 0 replies; 7+ messages in thread
From: Michael Snyder @ 2011-02-27 22:05 UTC (permalink / raw)
To: Mark Kettenis; +Cc: jan.kratochvil, gdb-patches, dje
Mark Kettenis wrote:
>> Date: Sun, 27 Feb 2011 13:27:31 -0800
>> From: Michael Snyder <msnyder@vmware.com>
>>
>>>> --- i386-low.c 1 Jan 2011 15:33:24 -0000 1.5
>>>> +++ i386-low.c 26 Feb 2011 22:48:38 -0000
>>> /* A macro to loop over all debug registers. */
>>> #define ALL_DEBUG_REGISTERS(i) for (i = 0; i < DR_NADDR; i++)
>>>> @@ -195,7 +195,7 @@ i386_show_dr (struct i386_debug_reg_stat
>>> ALL_DEBUG_REGISTERS(i)
>>> {
>>> printf_unfiltered ("\
>>>> \tDR%d: addr=0x%s, ref.count=%d DR%d: addr=0x%s, ref.count=%d\n",
>>>> i, paddress (state->dr_mirror[i]),
>>>> state->dr_ref_count[i],
>>>> - i + 1, paddress (state->dr_mirror[i + 1]),
>>>> + i + 1, paddress (state->dr_mirror[i]),
>>>> state->dr_ref_count[i + 1]);
>>>> i++;
>>>> }
>>> ->
>>> CONTROL (DR7): 0000000000090101 STATUS (DR6): 0000000000004000
>>> DR0: addr=0x0000000001c31f30, ref.count=1 DR1: addr=0x0000000000000000, ref.count=0
>>> DR2: addr=0x0000000000000000, ref.count=0 DR3: addr=0x0000000000000000, ref.count=0
>>>
>>> I do not see a bug there; still it could be better commented.
>> The bug is that when "i" is 3, "i + 1" is 4, and the array only runs
>> from 0 to 3.
>
> But i can't be 3.
Ah, ok, I'm finally seeing it.
So this is a false positive from Coverity.
This patch withdrawn.
Thanks for the review.
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [RFA] off by one array reference in i386-low.c/i386_show_dr
2011-02-26 23:24 [RFA] off by one array reference in i386-low.c/i386_show_dr Michael Snyder
2011-02-27 16:47 ` Jan Kratochvil
@ 2011-02-27 17:01 ` Pedro Alves
1 sibling, 0 replies; 7+ messages in thread
From: Pedro Alves @ 2011-02-27 17:01 UTC (permalink / raw)
To: gdb-patches; +Cc: Michael Snyder, Doug Evans
On Saturday 26 February 2011 22:52:23, Michael Snyder wrote:
> I'm not 100 percent sure this is right, but I do know that
> as written, it will overflow the array dr_mirror.
How? 'i' is incremented twice on each iteration.
> Index: i386-low.c
> ===================================================================
> RCS file: /cvs/src/src/gdb/gdbserver/i386-low.c,v
> retrieving revision 1.5
> diff -u -p -u -p -r1.5 i386-low.c
> --- i386-low.c 1 Jan 2011 15:33:24 -0000 1.5
> +++ i386-low.c 26 Feb 2011 22:48:38 -0000
> @@ -195,7 +195,7 @@ i386_show_dr (struct i386_debug_reg_stat
> \tDR%d: addr=0x%s, ref.count=%d DR%d: addr=0x%s, ref.count=%d\n",
> i, paddress (state->dr_mirror[i]),
> state->dr_ref_count[i],
> - i + 1, paddress (state->dr_mirror[i + 1]),
> + i + 1, paddress (state->dr_mirror[i]),
> state->dr_ref_count[i + 1]);
Even if there's chance of overflow that I'm not
seeing, this change is obviously wrong.
> i++;
> }
--
Pedro Alves
^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2011-02-27 22:00 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2011-02-26 23:24 [RFA] off by one array reference in i386-low.c/i386_show_dr Michael Snyder
2011-02-27 16:47 ` Jan Kratochvil
2011-02-27 21:33 ` Michael Snyder
2011-02-27 21:41 ` Jan Kratochvil
2011-02-27 21:50 ` Mark Kettenis
2011-02-27 22:05 ` Michael Snyder
2011-02-27 17:01 ` Pedro Alves
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox