* [PATCH v2 1/1] gdb: fix overflow caused by value_print_array_elements
2026-10-21 11:30 [PATCH v2 0/1] gdb: fix overflow caused by value_print_array_elements Stephan Rohr
@ 2026-10-21 11:30 ` Stephan Rohr
2026-10-21 16:38 ` Tom Tromey
0 siblings, 1 reply; 3+ messages in thread
From: Stephan Rohr @ 2026-10-21 11:30 UTC (permalink / raw)
To: gdb-patches; +Cc: tom
From: "Rohr, Stephan" <stephan.rohr@intel.com>
When printing an array whose stride is larger than its element type,
GDB allocates memory for each array element based on the element's
true type. The allocated buffer may include some padding.
"value_print_array_elements ()" passes the stride as the bit length to
"from_component_bitsize ()". This is silently swallowed if the stride
does not exceed the size of the allocated buffer but corrupts the heap
if the write goes beyond. Pass the size of the element's true type
instead.
---
gdb/testsuite/gdb.dwarf2/arr-stride-gap.exp | 106 ++++++++++++++++++++
gdb/valprint.c | 12 ++-
2 files changed, 115 insertions(+), 3 deletions(-)
create mode 100644 gdb/testsuite/gdb.dwarf2/arr-stride-gap.exp
diff --git a/gdb/testsuite/gdb.dwarf2/arr-stride-gap.exp b/gdb/testsuite/gdb.dwarf2/arr-stride-gap.exp
new file mode 100644
index 00000000000..008d18c59d4
--- /dev/null
+++ b/gdb/testsuite/gdb.dwarf2/arr-stride-gap.exp
@@ -0,0 +1,106 @@
+# Copyright 2026 Free Software Foundation, Inc.
+
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
+
+# Test printing arrays whose stride is larger and smaller than their element
+# type.
+
+load_lib dwarf.exp
+
+require dwarf2_support
+
+standard_testfile main.c -dw.S
+set asm_file [standard_output_file $srcfile2]
+
+# Array of two shorts with a 128-byte stride. The stride is chosen large
+# enough to safely exceed the buffer allocated for a 2-byte short.
+set stride 128
+set padding [lrepeat [expr {$stride - 1}] 0x00]
+set contents [list 0x01 {*}$padding 0x02 {*}$padding]
+
+# Array of two shorts with a 1-byte stride. Each element is read w.r.t. the
+# stride, not the element type.
+set packed_stride 1
+set packed_contents {0x01 0x02}
+
+Dwarf::assemble $asm_file {
+ cu {} {
+ DW_TAG_compile_unit {
+ DW_AT_language @DW_LANG_C99
+ } {
+ declare_labels short_label strided_label packed_label
+
+ short_label: DW_TAG_base_type {
+ DW_AT_byte_size 2 DW_FORM_sdata
+ DW_AT_encoding @DW_ATE_signed
+ DW_AT_name short
+ }
+
+ strided_label: DW_TAG_array_type {
+ DW_AT_type :$short_label
+ DW_AT_byte_stride $::stride DW_FORM_udata
+ } {
+ DW_TAG_subrange_type {
+ DW_AT_upper_bound 1 DW_FORM_data1
+ }
+ }
+
+ DW_TAG_variable {
+ DW_AT_name strided
+ DW_AT_type :$strided_label
+ DW_AT_location {
+ DW_OP_implicit_value {*}$::contents
+ } SPECIAL_expr
+ }
+
+ packed_label: DW_TAG_array_type {
+ DW_AT_type :$short_label
+ DW_AT_byte_stride $::packed_stride DW_FORM_udata
+ } {
+ DW_TAG_subrange_type {
+ DW_AT_upper_bound 1 DW_FORM_data1
+ }
+ }
+
+ DW_TAG_variable {
+ DW_AT_name packed
+ DW_AT_type :$packed_label
+ DW_AT_location {
+ DW_OP_implicit_value {*}$::packed_contents
+ } SPECIAL_expr
+ }
+ }
+ }
+}
+
+if {[prepare_for_testing "failed to prepare" $testfile \
+ [list $srcfile $asm_file] {nodebug}]} {
+ return
+}
+
+# Check that "print VAR" shows EXPECTED. A crash of GDB is converted into
+# "unresolved". Report it as a failure instead.
+proc test_print { var expected } {
+ gdb_test_multiple "print $var" "" {
+ -re -wrap " = $expected" {
+ pass $gdb_test_name
+ }
+ -re "A fatal error internal to GDB has been detected" {
+ fail "$gdb_test_name (GDB crashed)"
+ }
+ }
+}
+
+test_print strided "\\{1, 2\\}"
+test_print packed "\\{1, 2\\}"
diff --git a/gdb/valprint.c b/gdb/valprint.c
index 7e41943f66f..2c1782ab06a 100644
--- a/gdb/valprint.c
+++ b/gdb/valprint.c
@@ -1973,9 +1973,15 @@ value_print_array_elements (struct value *val, struct ui_file *stream,
struct type *type = check_typedef (val->type ());
elttype = type->target_type ();
- unsigned bit_stride = type->bit_stride ();
+ ULONGEST bit_stride = type->bit_stride ();
if (bit_stride == 0)
bit_stride = 8 * check_typedef (elttype)->length ();
+
+ /* For packed arrays, the stride may be smaller than the element's target
+ type. */
+ ULONGEST elt_bits = std::min (bit_stride,
+ 8 * check_typedef (elttype)->length ());
+
index_type = type->index_type ();
if (index_type->code () == TYPE_CODE_RANGE)
index_type = index_type->target_type ();
@@ -2026,7 +2032,7 @@ value_print_array_elements (struct value *val, struct ui_file *stream,
struct value *element = val->from_component_bitsize (elttype,
bit_stride * i,
- bit_stride);
+ elt_bits);
rep1 = i + 1;
reps = 1;
/* Only check for reps if repeat_count_threshold is not set to
@@ -2047,7 +2053,7 @@ value_print_array_elements (struct value *val, struct ui_file *stream,
struct value *rep_elt
= val->from_component_bitsize (elttype,
rep1 * bit_stride,
- bit_stride);
+ elt_bits);
bool repeated = ((available
&& rep_elt->entirely_available ()
&& element->contents_eq (rep_elt))
--
2.43.0
________________________________________
Intel Deutschland GmbH
Registered Address: Dornacher Strasse 1, 85622 Feldkirchen, Germany
Tel: +49 (89) 99143-0
www.intel.de
Managing Directors: Candice Moore, Jeffrey Schneiderman, Ramachandran Sitaraman
Chairperson of the Supervisory Board: Sonja Pierer
Registered Seat: Munich Commercial Register B: Amtsgericht Munich HRB 186928
This e-mail and any attachments may contain confidential material for
the sole use of the intended recipient(s). Any review or distribution
by others is strictly prohibited. If you are not the intended
recipient, please contact the sender and delete all copies.
^ permalink raw reply [flat|nested] 3+ messages in thread