From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from simark.ca by simark.ca with LMTP id I3JdBKCi2GpKeQIAWB0awg (envelope-from ) for ; Wed, 21 Oct 2026 07:31:44 -0400 Authentication-Results: simark.ca; dkim=pass (2048-bit key; unprotected) header.d=intel.com header.i=@intel.com header.a=rsa-sha256 header.s=Intel header.b=CmbuuGTg; dkim-atps=neutral Received: by simark.ca (Postfix, from userid 112) id F114B1E047; Wed, 21 Oct 2026 07:31:43 -0400 (EDT) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-25) on simark.ca X-Spam-Level: X-Spam-Status: No, score=-6.4 required=5.0 tests=ARC_SIGNED,ARC_VALID,BAYES_00, DKIMWL_WL_HIGH,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,MAILING_LIST_MULTI, RCVD_IN_DNSWL_MED autolearn=ham autolearn_force=no version=4.0.1 Received: from vm01.sourceware.org (vm01.sourceware.org [IPv6:2620:52:6:3111::32]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by simark.ca (Postfix) with ESMTPS id 5A6DE1E047 for ; Wed, 21 Oct 2026 07:31:42 -0400 (EDT) Received: from vm01.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id 949634BA23EE for ; Wed, 21 Oct 2026 11:31:40 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 949634BA23EE Authentication-Results: sourceware.org; dkim=pass (2048-bit key, unprotected) header.d=intel.com header.i=@intel.com header.a=rsa-sha256 header.s=Intel header.b=CmbuuGTg Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.9]) by sourceware.org (Postfix) with ESMTPS id 9920F4BA23CF for ; Wed, 21 Oct 2026 11:31:01 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 9920F4BA23CF Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=intel.com Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=intel.com ARC-Filter: OpenARC Filter v1.0.0 sourceware.org 9920F4BA23CF Authentication-Results: sourceware.org; arc=none smtp.remote-ip=192.198.163.9 ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1792582262; cv=none; b=I9dl2VoNpb2gMJiV9n1fla+yXCvWbZsmh+OMiNJIFAJhBkeG7EH3SEncLNtTClgtnFmAWtcji8k3adQDHjQ6i0yN2JhWdhOmgtS4qw4M9k10Y7CSwcaNtFMeAJAjYTFsGDgUvfEcEvhTlM5PxUacLfiOkRttlsiEMcKNkIaAOUc= ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1792582262; c=relaxed/simple; bh=Yb5yZuRQOOP0fSYCXGAhbg9UnZvxRegTRmIVcQO2UXI=; h=DKIM-Signature:From:To:Subject:Date:Message-ID:MIME-Version; b=C3bz8gsraYNrsMeSKw+qFCmFlhzeWtevzTkTo6EutZ6cPV6RGvvXys/gnFZZdCddVxZdvA3ZFbSG/F6j5M/e2PSALO1SARRJVZbt+sAkjFHvOqYJ7DCmdL30mTlO1/IkwXddGBRC0TKiI38v/t52HlglPNoSKWJrC5L/qSb/1AM= ARC-Authentication-Results: i=1; sourceware.org; dkim=pass (2048-bit key, unprotected) header.d=intel.com header.i=@intel.com header.a=rsa-sha256 header.s=Intel header.b=CmbuuGTg DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 9920F4BA23CF DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1792582262; x=1824118262; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=Yb5yZuRQOOP0fSYCXGAhbg9UnZvxRegTRmIVcQO2UXI=; b=CmbuuGTgV96D7SVTIlqSE1NQ3WOYVQjt4FTBXFzQ8kRuJx6ktAehMegO LHsSMQU39Abv9TfQYAIHZa/92saUwIY24qEavfe8fkAF4EMKBPUAjs2GI pmkF6XNZnKxEZFeMVAU1x97TjNAEqIhI7r0pLn1G06QJWvcpSRLaaFMEg iXvRALMnh7ceUJUeweFnQTXbXNX8qD1XjWihvTQehyl0iM1Phq2lzRjhx dHzuOIJbjZdxIEZNVfXCpkPZhmSa8RiQhe/A1j1kqqiI4FYub9SEBLa/V 90Gf008ViM8dGkVKfSmN3kd2Vr38XQAFgHQmj7pgDY12QNeRZ3bb2Obmh Q==; X-CSE-ConnectionGUID: kHRm2mU/RwaFfuQYzBuD8Q== X-CSE-MsgGUID: OuEGFlLSQaOb606ED5C++A== X-IronPort-AV: E=McAfee;i="6800,10657,11941"; a="1194846" X-IronPort-AV: E=Sophos;i="6.27,170,1787036400"; d="scan'208";a="1194846" Received: from fmviesa004.fm.intel.com ([10.60.135.144]) by fmvoesa103.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 21 Oct 2026 04:31:00 -0700 X-CSE-ConnectionGUID: Uzaw09iBTZeQpf3hx/883Q== X-CSE-MsgGUID: muvgghdoR4+ewKfN/Mb8iA== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.27,170,1787036400"; d="scan'208";a="3090222" Received: from dut1048pvc.igk.intel.com (HELO localhost) ([10.211.177.228]) by smtpauth.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 21 Oct 2026 04:30:59 -0700 From: Stephan Rohr To: gdb-patches@sourceware.org Cc: tom@tromey.com Subject: [PATCH v2 1/1] gdb: fix overflow caused by value_print_array_elements Date: Wed, 21 Oct 2026 11:30:45 +0000 Message-ID: <20261021113045.171468-2-stephan.rohr@intel.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261021113045.171468-1-stephan.rohr@intel.com> References: <20261021113045.171468-1-stephan.rohr@intel.com> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-BeenThere: gdb-patches@sourceware.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: Gdb-patches mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: gdb-patches-bounces~public-inbox=simark.ca@sourceware.org From: "Rohr, Stephan" When printing an array whose stride is larger than its element type, GDB allocates memory for each array element based on the element's true type. The allocated buffer may include some padding. "value_print_array_elements ()" passes the stride as the bit length to "from_component_bitsize ()". This is silently swallowed if the stride does not exceed the size of the allocated buffer but corrupts the heap if the write goes beyond. Pass the size of the element's true type instead. --- gdb/testsuite/gdb.dwarf2/arr-stride-gap.exp | 106 ++++++++++++++++++++ gdb/valprint.c | 12 ++- 2 files changed, 115 insertions(+), 3 deletions(-) create mode 100644 gdb/testsuite/gdb.dwarf2/arr-stride-gap.exp diff --git a/gdb/testsuite/gdb.dwarf2/arr-stride-gap.exp b/gdb/testsuite/gdb.dwarf2/arr-stride-gap.exp new file mode 100644 index 00000000000..008d18c59d4 --- /dev/null +++ b/gdb/testsuite/gdb.dwarf2/arr-stride-gap.exp @@ -0,0 +1,106 @@ +# Copyright 2026 Free Software Foundation, Inc. + +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 3 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see . + +# Test printing arrays whose stride is larger and smaller than their element +# type. + +load_lib dwarf.exp + +require dwarf2_support + +standard_testfile main.c -dw.S +set asm_file [standard_output_file $srcfile2] + +# Array of two shorts with a 128-byte stride. The stride is chosen large +# enough to safely exceed the buffer allocated for a 2-byte short. +set stride 128 +set padding [lrepeat [expr {$stride - 1}] 0x00] +set contents [list 0x01 {*}$padding 0x02 {*}$padding] + +# Array of two shorts with a 1-byte stride. Each element is read w.r.t. the +# stride, not the element type. +set packed_stride 1 +set packed_contents {0x01 0x02} + +Dwarf::assemble $asm_file { + cu {} { + DW_TAG_compile_unit { + DW_AT_language @DW_LANG_C99 + } { + declare_labels short_label strided_label packed_label + + short_label: DW_TAG_base_type { + DW_AT_byte_size 2 DW_FORM_sdata + DW_AT_encoding @DW_ATE_signed + DW_AT_name short + } + + strided_label: DW_TAG_array_type { + DW_AT_type :$short_label + DW_AT_byte_stride $::stride DW_FORM_udata + } { + DW_TAG_subrange_type { + DW_AT_upper_bound 1 DW_FORM_data1 + } + } + + DW_TAG_variable { + DW_AT_name strided + DW_AT_type :$strided_label + DW_AT_location { + DW_OP_implicit_value {*}$::contents + } SPECIAL_expr + } + + packed_label: DW_TAG_array_type { + DW_AT_type :$short_label + DW_AT_byte_stride $::packed_stride DW_FORM_udata + } { + DW_TAG_subrange_type { + DW_AT_upper_bound 1 DW_FORM_data1 + } + } + + DW_TAG_variable { + DW_AT_name packed + DW_AT_type :$packed_label + DW_AT_location { + DW_OP_implicit_value {*}$::packed_contents + } SPECIAL_expr + } + } + } +} + +if {[prepare_for_testing "failed to prepare" $testfile \ + [list $srcfile $asm_file] {nodebug}]} { + return +} + +# Check that "print VAR" shows EXPECTED. A crash of GDB is converted into +# "unresolved". Report it as a failure instead. +proc test_print { var expected } { + gdb_test_multiple "print $var" "" { + -re -wrap " = $expected" { + pass $gdb_test_name + } + -re "A fatal error internal to GDB has been detected" { + fail "$gdb_test_name (GDB crashed)" + } + } +} + +test_print strided "\\{1, 2\\}" +test_print packed "\\{1, 2\\}" diff --git a/gdb/valprint.c b/gdb/valprint.c index 7e41943f66f..2c1782ab06a 100644 --- a/gdb/valprint.c +++ b/gdb/valprint.c @@ -1973,9 +1973,15 @@ value_print_array_elements (struct value *val, struct ui_file *stream, struct type *type = check_typedef (val->type ()); elttype = type->target_type (); - unsigned bit_stride = type->bit_stride (); + ULONGEST bit_stride = type->bit_stride (); if (bit_stride == 0) bit_stride = 8 * check_typedef (elttype)->length (); + + /* For packed arrays, the stride may be smaller than the element's target + type. */ + ULONGEST elt_bits = std::min (bit_stride, + 8 * check_typedef (elttype)->length ()); + index_type = type->index_type (); if (index_type->code () == TYPE_CODE_RANGE) index_type = index_type->target_type (); @@ -2026,7 +2032,7 @@ value_print_array_elements (struct value *val, struct ui_file *stream, struct value *element = val->from_component_bitsize (elttype, bit_stride * i, - bit_stride); + elt_bits); rep1 = i + 1; reps = 1; /* Only check for reps if repeat_count_threshold is not set to @@ -2047,7 +2053,7 @@ value_print_array_elements (struct value *val, struct ui_file *stream, struct value *rep_elt = val->from_component_bitsize (elttype, rep1 * bit_stride, - bit_stride); + elt_bits); bool repeated = ((available && rep_elt->entirely_available () && element->contents_eq (rep_elt)) -- 2.43.0 ________________________________________ Intel Deutschland GmbH Registered Address: Dornacher Strasse 1, 85622 Feldkirchen, Germany Tel: +49 (89) 99143-0 www.intel.de Managing Directors: Candice Moore, Jeffrey Schneiderman, Ramachandran Sitaraman Chairperson of the Supervisory Board: Sonja Pierer Registered Seat: Munich Commercial Register B: Amtsgericht Munich HRB 186928 This e-mail and any attachments may contain confidential material for the sole use of the intended recipient(s). Any review or distribution by others is strictly prohibited. If you are not the intended recipient, please contact the sender and delete all copies.