From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from simark.ca by simark.ca with LMTP id RlQaN0Kh0GplOxAAWB0awg (envelope-from ) for ; Thu, 15 Oct 2026 05:47:46 -0400 Authentication-Results: simark.ca; dkim=pass (2048-bit key; unprotected) header.d=intel.com header.i=@intel.com header.a=rsa-sha256 header.s=Intel header.b=kxBOXa7p; dkim-atps=neutral Received: by simark.ca (Postfix, from userid 112) id A3E151E050; Thu, 15 Oct 2026 05:47:46 -0400 (EDT) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-25) on simark.ca X-Spam-Level: X-Spam-Status: No, score=-3.4 required=5.0 tests=ARC_SIGNED,ARC_VALID,BAYES_00, DKIMWL_WL_HIGH,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,MAILING_LIST_MULTI, RCVD_IN_DNSWL_MED,RCVD_IN_VALIDITY_CERTIFIED_BLOCKED, RCVD_IN_VALIDITY_RPBL_BLOCKED,RCVD_IN_VALIDITY_SAFE_BLOCKED autolearn=ham autolearn_force=no version=4.0.1 Received: from vm01.sourceware.org (vm01.sourceware.org [38.145.34.32]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by simark.ca (Postfix) with ESMTPS id 117F91E047 for ; Thu, 15 Oct 2026 05:47:42 -0400 (EDT) Received: from vm01.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id 189AC4BA2E2A for ; Thu, 15 Oct 2026 09:47:41 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 189AC4BA2E2A Authentication-Results: sourceware.org; dkim=pass (2048-bit key, unprotected) header.d=intel.com header.i=@intel.com header.a=rsa-sha256 header.s=Intel header.b=kxBOXa7p Received: from mgamail.intel.com (mgamail.intel.com [198.175.65.17]) by sourceware.org (Postfix) with ESMTPS id A12A14BA2E0F for ; Thu, 15 Oct 2026 09:47:12 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org A12A14BA2E0F Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=intel.com Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=intel.com ARC-Filter: OpenARC Filter v1.0.0 sourceware.org A12A14BA2E0F Authentication-Results: sourceware.org; arc=none smtp.remote-ip=198.175.65.17 ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1792057633; cv=none; b=prcY4rfLuptq9AcOPQ52TjhyMGUNfGlgBczLq9ZLczt42ZEPWwRouS2MCWD7Lbn2lqDp5rT+L9ns9ns28ulBSYaSbmMd5QgJb/qF0d4WXm57EduyEEX9eq3yCgeiP46xHr1hsj74cad4N/BoeZ9mgQP9420uhPbXy/iJyCvcm/o= ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1792057633; c=relaxed/simple; bh=aipKYrmlUp+6sOxxeFOtSYl0CAV6N6H+EnK1hVNQBLs=; h=DKIM-Signature:From:To:Subject:Date:Message-ID:MIME-Version; b=KASSxCOEzbSDaDVhqLYox+58EUEODXgjaomZIs3Gs8P20vVNlsqj5koFe6Pmm9/NJ5Zq2oRMfAZdJ4OaKdtTSMq84sb/99Gui0Jbp+0bKvpDDtLXTB/b0attpkrWspTIsQv0WnGcDavzon8XqM53JfqwqdEtqMzHy740l7wnkm8= ARC-Authentication-Results: i=1; sourceware.org; dkim=pass (2048-bit key, unprotected) header.d=intel.com header.i=@intel.com header.a=rsa-sha256 header.s=Intel header.b=kxBOXa7p DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org A12A14BA2E0F DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1792057633; x=1823593633; h=from:to:subject:date:message-id:mime-version: content-transfer-encoding; bh=aipKYrmlUp+6sOxxeFOtSYl0CAV6N6H+EnK1hVNQBLs=; b=kxBOXa7pPU9MhK4E1B+5BIafnrsUBrx/rtqrMarPKsoiPVX1dbpF1q0T zv1CG7eDVOIJOAaHD26IWa0zXKoMsd6tXWM+rwKzPSF9lpAZCKMOvp8jM p7hJsRjJYI69MfVBeUGUntkPWf3I/oRZVpACwJ+gv4HwellvuL5AVHJfG 72yd3PWXArfcABUckWn5cZbCxpPOe8M9OGPnoBcm6ZPGF3XU5nt0XjpjP SYW2JdzpAg9+iwnMYh/Mn3Y3tR0F7cA20z//8Krey0Q/AEJSQZdaKQ/62 ajoR4+Z5lJXvD5RgH1IaOMpzK23uEmqwPbaMyqfohMhcEJPyY6l5F0UVE g==; X-CSE-ConnectionGUID: ipY+i6PzTmyjcBnoFdO56A== X-CSE-MsgGUID: LfcOkAY/R/6LkM5JmwKRug== X-IronPort-AV: E=McAfee;i="6800,10657,11935"; a="832185" X-IronPort-AV: E=Sophos;i="6.27,159,1787036400"; d="scan'208";a="832185" Received: from fmviesa006.fm.intel.com ([10.60.135.146]) by orvoesa109.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 15 Oct 2026 02:47:11 -0700 X-CSE-ConnectionGUID: L+XLCptURfO8fmZ4uIARWA== X-CSE-MsgGUID: ksv6Ga+QQoqMuC4XIAmxeA== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.27,159,1787036400"; d="scan'208";a="2014545" Received: from dut1048pvc.igk.intel.com (HELO localhost) ([10.211.177.228]) by smtpauth.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 15 Oct 2026 02:47:10 -0700 From: Stephan Rohr To: gdb-patches@sourceware.org Subject: [PATCH] gdb: fix overflow caused by value_print_array_elements Date: Thu, 15 Oct 2026 09:47:03 +0000 Message-ID: <20261015094703.112063-1-stephan.rohr@intel.com> X-Mailer: git-send-email 2.43.0 MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-BeenThere: gdb-patches@sourceware.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: Gdb-patches mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: gdb-patches-bounces~public-inbox=simark.ca@sourceware.org From: "Rohr, Stephan" When printing an array whose stride is larger than its element type, GDB allocates memory for each array element based on the element's true type. The allocated buffer may include some padding. "value_print_array_elements ()" passes the stride as the bit length to "from_component_bitsize ()". This is silently swallowed if the stride does not exceed the size of the allocated buffer but corrupts the heap if the write goes beyond. Pass the size of the element's true type ^instead. --- gdb/testsuite/gdb.dwarf2/arr-stride-gap.exp | 78 +++++++++++++++++++++ gdb/valprint.c | 12 +++- 2 files changed, 87 insertions(+), 3 deletions(-) create mode 100644 gdb/testsuite/gdb.dwarf2/arr-stride-gap.exp diff --git a/gdb/testsuite/gdb.dwarf2/arr-stride-gap.exp b/gdb/testsuite/gdb.dwarf2/arr-stride-gap.exp new file mode 100644 index 00000000000..6e9dee5bd19 --- /dev/null +++ b/gdb/testsuite/gdb.dwarf2/arr-stride-gap.exp @@ -0,0 +1,78 @@ +# Copyright 2026 Free Software Foundation, Inc. + +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 3 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see . + +# Test printing an array whose stride is larger than its element type. + +load_lib dwarf.exp + +require dwarf2_support + +standard_testfile main.c -dw.S +set asm_file [standard_output_file $srcfile2] + +# Array of two shorts with a 128-byte stride. The stride is chosen large +# enough to safely exceed the buffer allocated for a 2-byte short. +set stride 128 +set padding [lrepeat [expr {$stride - 1}] 0x00] +set contents [list 0x01 {*}$padding 0x02 {*}$padding] + +Dwarf::assemble $asm_file { + cu {} { + DW_TAG_compile_unit { + DW_AT_language @DW_LANG_C99 + } { + declare_labels short_label array_label + + short_label: DW_TAG_base_type { + DW_AT_byte_size 2 DW_FORM_sdata + DW_AT_encoding @DW_ATE_signed + DW_AT_name short + } + + array_label: DW_TAG_array_type { + DW_AT_type :$short_label + DW_AT_byte_stride $::stride DW_FORM_udata + } { + DW_TAG_subrange_type { + DW_AT_upper_bound 1 DW_FORM_data1 + } + } + + DW_TAG_variable { + DW_AT_name strided + DW_AT_type :$array_label + DW_AT_location { + DW_OP_implicit_value {*}$::contents + } SPECIAL_expr + } + } + } +} + +if {[prepare_for_testing "failed to prepare" $testfile \ + [list $srcfile $asm_file] {nodebug}]} { + return +} + +# A crash of GDB is converted into "unresolved". Report it as a failure +# instead. +gdb_test_multiple "print strided" "" { + -re -wrap " = \\{1, 2\\}" { + pass $gdb_test_name + } + -re "A fatal error internal to GDB has been detected" { + fail "$gdb_test_name (GDB crashed)" + } +} diff --git a/gdb/valprint.c b/gdb/valprint.c index 7e41943f66f..2c1782ab06a 100644 --- a/gdb/valprint.c +++ b/gdb/valprint.c @@ -1973,9 +1973,15 @@ value_print_array_elements (struct value *val, struct ui_file *stream, struct type *type = check_typedef (val->type ()); elttype = type->target_type (); - unsigned bit_stride = type->bit_stride (); + ULONGEST bit_stride = type->bit_stride (); if (bit_stride == 0) bit_stride = 8 * check_typedef (elttype)->length (); + + /* For packed arrays, the stride may be smaller than the element's target + type. */ + ULONGEST elt_bits = std::min (bit_stride, + 8 * check_typedef (elttype)->length ()); + index_type = type->index_type (); if (index_type->code () == TYPE_CODE_RANGE) index_type = index_type->target_type (); @@ -2026,7 +2032,7 @@ value_print_array_elements (struct value *val, struct ui_file *stream, struct value *element = val->from_component_bitsize (elttype, bit_stride * i, - bit_stride); + elt_bits); rep1 = i + 1; reps = 1; /* Only check for reps if repeat_count_threshold is not set to @@ -2047,7 +2053,7 @@ value_print_array_elements (struct value *val, struct ui_file *stream, struct value *rep_elt = val->from_component_bitsize (elttype, rep1 * bit_stride, - bit_stride); + elt_bits); bool repeated = ((available && rep_elt->entirely_available () && element->contents_eq (rep_elt)) -- 2.43.0 ________________________________________ Intel Deutschland GmbH Registered Address: Dornacher Strasse 1, 85622 Feldkirchen, Germany Tel: +49 (89) 99143-0 www.intel.de Managing Directors: Candice Moore, Jeffrey Schneiderman, Ramachandran Sitaraman Chairperson of the Supervisory Board: Sonja Pierer Registered Seat: Munich Commercial Register B: Amtsgericht Munich HRB 186928 This e-mail and any attachments may contain confidential material for the sole use of the intended recipient(s). Any review or distribution by others is strictly prohibited. If you are not the intended recipient, please contact the sender and delete all copies.