From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 24255 invoked by alias); 13 Mar 2012 22:36:14 -0000 Received: (qmail 24065 invoked by uid 22791); 13 Mar 2012 22:36:13 -0000 X-SWARE-Spam-Status: No, hits=-2.0 required=5.0 tests=AWL,BAYES_00,TW_EG X-Spam-Check-By: sourceware.org Received: from rock.gnat.com (HELO rock.gnat.com) (205.232.38.15) by sourceware.org (qpsmtpd/0.43rc1) with ESMTP; Tue, 13 Mar 2012 22:36:00 +0000 Received: from localhost (localhost.localdomain [127.0.0.1]) by filtered-rock.gnat.com (Postfix) with ESMTP id 63A061C6AD4; Tue, 13 Mar 2012 18:35:59 -0400 (EDT) Received: from rock.gnat.com ([127.0.0.1]) by localhost (rock.gnat.com [127.0.0.1]) (amavisd-new, port 10024) with LMTP id 4srxZhd37ohg; Tue, 13 Mar 2012 18:35:59 -0400 (EDT) Received: from joel.gnat.com (localhost.localdomain [127.0.0.1]) by rock.gnat.com (Postfix) with ESMTP id 2725F1C6ACF; Tue, 13 Mar 2012 18:35:58 -0400 (EDT) Received: by joel.gnat.com (Postfix, from userid 1000) id 9470E145615; Tue, 13 Mar 2012 15:35:51 -0700 (PDT) Date: Tue, 13 Mar 2012 22:36:00 -0000 From: Joel Brobecker To: Chris January Cc: gdb-patches@sourceware.org Subject: Re: [PATCH] AIX: Fix buffer overflow in fill_fprs Message-ID: <20120313223551.GW2853@adacore.com> References: <1331212547.2742.4.camel@gumtree> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="ZmUaFz6apKcXQszQ" Content-Disposition: inline In-Reply-To: <1331212547.2742.4.camel@gumtree> User-Agent: Mutt/1.5.20 (2009-06-14) Mailing-List: contact gdb-patches-help@sourceware.org; run by ezmlm Precedence: bulk List-Id: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: gdb-patches-owner@sourceware.org X-SW-Source: 2012-03/txt/msg00452.txt.bz2 --ZmUaFz6apKcXQszQ Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-length: 849 > The callers of fill_fprs expect the first floating point register to be > written to vals[0], but it's currently written to > vals[tdep->ppc_fp0_regnum] which can cause GDB to segfault as the > caller's buffer overflows. > > 2012-03-08 Chris January > > * aix-thread.c (fill_sprs): Store the floating point registers > at the correct offsets into vals. This looks right to me. I tested it on AIX for you and checked it in. While doing this, I looked at the opposite function, and found that it was ok, but with a regno meaning something different. The implementation in fill_sprs seems more natural to me, so I fixed supply_fprs as attached. Thanks again for the patch. PS: I reformatted your ChangeLog entry. We try to keep lines under 70 characters long, with a hard-limit at 80 characters... -- Joel --ZmUaFz6apKcXQszQ Content-Type: text/x-diff; charset=us-ascii Content-Disposition: attachment; filename="0001-Minor-cleanup-in-aix-thread.c-supply_fprs.patch" Content-length: 1642 >From 7cd4e229d7d23046706970cde3cc34387039a4e7 Mon Sep 17 00:00:00 2001 From: Joel Brobecker Date: Tue, 13 Mar 2012 15:21:57 -0700 Subject: [PATCH] Minor cleanup in aix-thread.c:supply_fprs. This is a minor cleanup that makes supply_fprs more consistent with how fill_fprs was written. gdb/ChangeLog: * aix-thread.c (supply_fprs): Make more consistent with fill_fprs. --- gdb/ChangeLog | 4 ++++ gdb/aix-thread.c | 8 +++++--- 2 files changed, 9 insertions(+), 3 deletions(-) diff --git a/gdb/ChangeLog b/gdb/ChangeLog index 4725f54..480ce34 100644 --- a/gdb/ChangeLog +++ b/gdb/ChangeLog @@ -1,3 +1,7 @@ +2012-03-13 Joel Brobecker + + * aix-thread.c (supply_fprs): Make more consistent with fill_fprs. + 2012-03-13 Chris January * aix-thread.c (fill_sprs): Store the floating point registers diff --git a/gdb/aix-thread.c b/gdb/aix-thread.c index f9787e3..534f731 100644 --- a/gdb/aix-thread.c +++ b/gdb/aix-thread.c @@ -1075,9 +1075,11 @@ supply_fprs (struct regcache *regcache, double *vals) floating-point registers. */ gdb_assert (ppc_floating_point_unit_p (gdbarch)); - for (regno = 0; regno < ppc_num_fprs; regno++) - regcache_raw_supply (regcache, regno + tdep->ppc_fp0_regnum, - (char *) (vals + regno)); + for (regno = tdep->ppc_fp0_regnum; + regno < tdep->ppc_fp0_regnum + ppc_num_fprs; + regno++) + regcache_raw_supply (regcache, regno, + (char *) (vals + regno - tdep->ppc_fp0_regnum)); } /* Predicate to test whether given register number is a "special" register. */ -- 1.7.1 --ZmUaFz6apKcXQszQ--