[PATCH] Return lazy value from allocate_repeat_value

[Tom Tromey <tromey@adacore.com>]

A user noticed that the "@" operator could cause a crash in gdb.  The
bug here was that value::allocate_contents might limit the amount of
memory allocated for the contents, but value_repeat did not respect
this.

This patch fixes the problem by having allocate_repeat_value return a
lazy value.  This defers to the memory reading to the "usual" code
that does respect these limits.

Regression tested on x86-64 Fedora 43.

Note that the new test only reliably fails in an ASAN build.

Bug: https://sourceware.org/bugzilla/show_bug.cgi?id=34132
---
 gdb/testsuite/gdb.base/printcmds.exp | 9 +++++++++
 gdb/valops.c                         | 4 ----
 gdb/value.c                          | 2 +-
 3 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/gdb/testsuite/gdb.base/printcmds.exp b/gdb/testsuite/gdb.base/printcmds.exp
index 12933d898ed..0600eaf2ab6 100644
--- a/gdb/testsuite/gdb.base/printcmds.exp
+++ b/gdb/testsuite/gdb.base/printcmds.exp
@@ -717,6 +717,15 @@ proc test_artificial_arrays {} {
 	{p int1dim[0]@TWO@three}
     gdb_test_escape_braces {p/x (short [])0x12345678} \
 	" = ({0x1234, 0x5678}|{0x5678, 0x1234})"
+
+    # A regression test for a buffer overflow.  PR gdb/34132.
+    gdb_test_no_output {set $ctable = (char *) ctable2}
+    gdb_test_no_output "set max-value-size 16"
+    gdb_test_no_output "set print elements 10"
+    gdb_test {print $ctable[0] @ 20} \
+	[quotemeta {$@DECIMAL = {97 'a', 88 'X' <repeats 15 times>...}}]
+    gdb_test_no_output "set max-value-size 65536"
+    gdb_test_no_output "set print elements 200"
 }
 
 proc test_print_char_arrays {} {
diff --git a/gdb/valops.c b/gdb/valops.c
index a235a0ebe8d..f9d83ce81f8 100644
--- a/gdb/valops.c
+++ b/gdb/valops.c
@@ -1387,10 +1387,6 @@ value_repeat (struct value *arg1, int count)
   val->set_lval (lval_memory);
   val->set_address (arg1->address ());
 
-  read_value_memory (val, 0, val->stack (), val->address (),
-		     val->contents_all_raw ().data (),
-		     type_length_units (val->enclosing_type ()));
-
   return val;
 }
 
diff --git a/gdb/value.c b/gdb/value.c
index d7c724757ce..6061d346dd5 100644
--- a/gdb/value.c
+++ b/gdb/value.c
@@ -1025,7 +1025,7 @@ allocate_repeat_value (struct type *type, int count)
   struct type *array_type
     = lookup_array_range_type (type, low_bound, count + low_bound - 1);
 
-  return value::allocate (array_type);
+  return value::allocate_lazy (array_type);
 }
 
 struct value *

base-commit: 3e5100fe3b15e2b3ece60f57b4c1ecc0c50cae53
-- 
2.55.0