[PATCH] gdb: fix overflow caused by value_print_array_elements

[PATCH] gdb: fix overflow caused by value_print_array_elements

[Stephan Rohr]

From: "Rohr, Stephan" <stephan.rohr@intel.com>

When printing an array whose stride is larger than its element type,
GDB allocates memory for each array element based on the element's
true type.  The allocated buffer may include some padding.
"value_print_array_elements ()" passes the stride as the bit length to
"from_component_bitsize ()".  This is silently swallowed if the stride
does not exceed the size of the allocated buffer but corrupts the heap
if the write goes beyond.  Pass the size of the element's true type
^instead.
---
 gdb/testsuite/gdb.dwarf2/arr-stride-gap.exp | 78 +++++++++++++++++++++
 gdb/valprint.c                              | 12 +++-
 2 files changed, 87 insertions(+), 3 deletions(-)
 create mode 100644 gdb/testsuite/gdb.dwarf2/arr-stride-gap.exp

diff --git a/gdb/testsuite/gdb.dwarf2/arr-stride-gap.exp b/gdb/testsuite/gdb.dwarf2/arr-stride-gap.exp
new file mode 100644
index 00000000000..6e9dee5bd19
--- /dev/null
+++ b/gdb/testsuite/gdb.dwarf2/arr-stride-gap.exp
@@ -0,0 +1,78 @@
+# Copyright 2026 Free Software Foundation, Inc.
+
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# Test printing an array whose stride is larger than its element type.
+
+load_lib dwarf.exp
+
+require dwarf2_support
+
+standard_testfile main.c -dw.S
+set asm_file [standard_output_file $srcfile2]
+
+# Array of two shorts with a 128-byte stride.  The stride is chosen large
+# enough to safely exceed the buffer allocated for a 2-byte short.
+set stride 128
+set padding [lrepeat [expr {$stride - 1}] 0x00]
+set contents [list 0x01 {*}$padding 0x02 {*}$padding]
+
+Dwarf::assemble $asm_file {
+    cu {} {
+	DW_TAG_compile_unit {
+	    DW_AT_language @DW_LANG_C99
+	} {
+	    declare_labels short_label array_label
+
+	    short_label: DW_TAG_base_type {
+		DW_AT_byte_size 2 DW_FORM_sdata
+		DW_AT_encoding @DW_ATE_signed
+		DW_AT_name short
+	    }
+
+	    array_label: DW_TAG_array_type {
+		DW_AT_type :$short_label
+		DW_AT_byte_stride $::stride DW_FORM_udata
+	    } {
+		DW_TAG_subrange_type {
+		    DW_AT_upper_bound 1 DW_FORM_data1
+		}
+	    }
+
+	    DW_TAG_variable {
+		DW_AT_name strided
+		DW_AT_type :$array_label
+		DW_AT_location {
+		    DW_OP_implicit_value {*}$::contents
+		} SPECIAL_expr
+	    }
+	}
+    }
+}
+
+if {[prepare_for_testing "failed to prepare" $testfile \
+	 [list $srcfile $asm_file] {nodebug}]} {
+    return
+}
+
+# A crash of GDB is converted into "unresolved".  Report it as a failure
+# instead.
+gdb_test_multiple "print strided" "" {
+    -re -wrap " = \\{1, 2\\}" {
+	pass $gdb_test_name
+    }
+    -re "A fatal error internal to GDB has been detected" {
+	fail "$gdb_test_name (GDB crashed)"
+    }
+}
diff --git a/gdb/valprint.c b/gdb/valprint.c
index 7e41943f66f..2c1782ab06a 100644
--- a/gdb/valprint.c
+++ b/gdb/valprint.c
@@ -1973,9 +1973,15 @@ value_print_array_elements (struct value *val, struct ui_file *stream,
   struct type *type = check_typedef (val->type ());
 
   elttype = type->target_type ();
-  unsigned bit_stride = type->bit_stride ();
+  ULONGEST bit_stride = type->bit_stride ();
   if (bit_stride == 0)
     bit_stride = 8 * check_typedef (elttype)->length ();
+
+  /* For packed arrays, the stride may be smaller than the element's target
+     type.  */
+  ULONGEST elt_bits = std::min (bit_stride,
+				8 * check_typedef (elttype)->length ());
+
   index_type = type->index_type ();
   if (index_type->code () == TYPE_CODE_RANGE)
     index_type = index_type->target_type ();
@@ -2026,7 +2032,7 @@ value_print_array_elements (struct value *val, struct ui_file *stream,
 
       struct value *element = val->from_component_bitsize (elttype,
 							   bit_stride * i,
-							   bit_stride);
+							   elt_bits);
       rep1 = i + 1;
       reps = 1;
       /* Only check for reps if repeat_count_threshold is not set to
@@ -2047,7 +2053,7 @@ value_print_array_elements (struct value *val, struct ui_file *stream,
 	      struct value *rep_elt
 		= val->from_component_bitsize (elttype,
 					       rep1 * bit_stride,
-					       bit_stride);
+					       elt_bits);
 	      bool repeated = ((available
 				&& rep_elt->entirely_available ()
 				&& element->contents_eq (rep_elt))
-- 
2.43.0

________________________________________
Intel Deutschland GmbH 

Registered Address: Dornacher Strasse 1, 85622 Feldkirchen, Germany 

Tel: +49 (89) 99143-0 

www.intel.de 

Managing Directors: Candice Moore, Jeffrey Schneiderman, Ramachandran Sitaraman

Chairperson of the Supervisory Board: Sonja Pierer

Registered Seat: Munich Commercial Register B: Amtsgericht Munich HRB 186928

This e-mail and any attachments may contain confidential material for
the sole use of the intended recipient(s). Any review or distribution
by others is strictly prohibited. If you are not the intended
recipient, please contact the sender and delete all copies.

Re: [PATCH] gdb: fix overflow caused by value_print_array_elements

[Tom Tromey]

>>>>> Stephan Rohr <stephan.rohr@intel.com> writes:

Thanks for the patch.

> From: "Rohr, Stephan" <stephan.rohr@intel.com>
> When printing an array whose stride is larger than its element type,
> GDB allocates memory for each array element based on the element's
> true type.  The allocated buffer may include some padding.
> "value_print_array_elements ()" passes the stride as the bit length to
> "from_component_bitsize ()".  This is silently swallowed if the stride
> does not exceed the size of the allocated buffer but corrupts the heap
> if the write goes beyond.  Pass the size of the element's true type
> ^instead.

Stray "^" here.

> +
> +  /* For packed arrays, the stride may be smaller than the element's target
> +     type.  */
> +  ULONGEST elt_bits = std::min (bit_stride,
> +				8 * check_typedef (elttype)->length ());

I think it would be good if the test case included a case where the
stride is smaller than the element's type.  I think currently it only
tests the case where the element type is smaller than the stride.

Tom