[PATCH] [gdb/tui] Fix segfault in tui_win_info::forward_scroll

[Tom de Vries <tdevries@suse.de>]

Consider the following setup: we create a TUI layout with only the command
window, and enable it:
...
(gdb) tui new-layout command-layout cmd 1
(gdb) layout command-layout
...

Now say we use the "scroll window forward" command:
...
(gdb) help +
Scroll window forward.
Usage: + [N] [WIN]
Scroll window WIN N lines forwards.  Both WIN and N are optional, N
defaults to 1, and WIN defaults to the currently focused window.
...
on the command window:
...
(gdb) + 1 cmd
...

We run into a segfault in tui_win_info::forward_scroll because this is
nullptr.

That happens because in parse_scrolling_args we do:
...
	      else if (*win_to_scroll == tui_cmd_win ())
		*win_to_scroll = *(tui_source_windows ().begin ());
...
while tui_source_windows () is an empty range.

Dereferencing begin () for an empty range means dereferencing end (), which is
undefined behavior.  But it happens to set *win_to_scroll to nullptr.

Tui_scroll_forward_command doesn't expect a nullptr win_to_scroll, and just
dereferences it:
...
  if (arg == NULL)
    parse_scrolling_args (arg, &win_to_scroll, NULL);
  else
    parse_scrolling_args (arg, &win_to_scroll, &num_to_scroll);
  win_to_scroll->forward_scroll (num_to_scroll);
...
which causes the segfault in tui_win_info::forward_scroll.

Fix this conservatively, by ignoring the scroll if there are no source
windows.

While working on this patch, I noticed a related problem in
parse_scrolling_args: there's a difference in behavior between the cases where
you specify the command window implicitly (command window has focus) and
explicitly [1].

More concretely, in a TUI setup with source and command window, and the focus
on the command window, this command (using the command window, because it's
the one with focus) has no effect:
...
(gdb) + 1
...
but this command (using the command window, because it's explicitly specified)
scrolls the source window:
...
(gdb) + 1 cmd
...

This behavior is not specified in the documentation or help message, not
checked in the testsuite and not replicated in any of the other scroll
methods.

So an alternative way of fixing this would be to drop the special treatment of
the command window in parse_scrolling_args, and fix both PRs that way.

Tested on x86_64-linux.

Bug: https://sourceware.org/bugzilla/show_bug.cgi?id=34772

[1] https://sourceware.org/bugzilla/show_bug.cgi?id=34773
---
 gdb/testsuite/gdb.tui/cmd-layout.exp | 46 ++++++++++++++++++++++++++++
 gdb/tui/tui-win.c                    |  9 +++++-
 2 files changed, 54 insertions(+), 1 deletion(-)
 create mode 100644 gdb/testsuite/gdb.tui/cmd-layout.exp

diff --git a/gdb/testsuite/gdb.tui/cmd-layout.exp b/gdb/testsuite/gdb.tui/cmd-layout.exp
new file mode 100644
index 00000000000..d83b951b884
--- /dev/null
+++ b/gdb/testsuite/gdb.tui/cmd-layout.exp
@@ -0,0 +1,46 @@
+# Copyright 2026 Free Software Foundation, Inc.
+
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# Check layout with only a command window.
+
+require allow_tui_tests
+
+tuiterm_env
+
+Term::clean_restart 24 80
+
+# Use a layout with just a command window.
+gdb_test_no_output "tui new-layout command-layout cmd 1"
+
+if {![Term::prepare_for_tui]} {
+    unsupported "TUI not supported"
+    return
+}
+
+# Enter TUI.
+gdb_assert {[Term::command_no_prompt_prefix "layout command-layout"]} \
+    "activated layout"
+
+foreach op {+ - < >} {
+    gdb_assert {[Term::command "$op"]} \
+	"scroll command: $op"
+
+    gdb_assert {[Term::command "$op 1"]} \
+	"scroll command: $op 1"
+
+    # Regression test for PR34772.  This used to trigger a segfault.
+    gdb_assert {[Term::command "$op 1 cmd"]} \
+	"scroll command: $op 1 cmd"
+}
diff --git a/gdb/tui/tui-win.c b/gdb/tui/tui-win.c
index 7b174b13913..8f9c4ab443d 100644
--- a/gdb/tui/tui-win.c
+++ b/gdb/tui/tui-win.c
@@ -1073,7 +1073,14 @@ parse_scrolling_args (const char *arg,
 	      if (!(*win_to_scroll)->is_visible ())
 		error (_("Window is not visible"));
 	      else if (*win_to_scroll == tui_cmd_win ())
-		*win_to_scroll = *(tui_source_windows ().begin ());
+		{
+		  /* If there's a source window, pick the first one.
+		     Otherwise, let the command window ignore the scroll.  */
+		  auto range = tui_source_windows ();
+		  auto first = range.begin ();
+		  if (first != range.end ())
+		    *win_to_scroll = *first;
+		}
 	    }
 	}
     }

base-commit: cfd8ea4e101d9793895d9b8b016da5c2ec6a672a
-- 
2.51.0