Re: [PATCH v3] gdb: replace alloca with gdb::unique_xmalloc_ptr in remote-fileio.c

[Pedro Alves <pedro@palves.net>]

On 2026-07-01 20:01, Luis Machado wrote:
> remote_fileio_extract_ptr_w_len parsed a debuggee controlled 64 bit
> length, narrowed it to int with no bounds check, and the value flowed
> directly into alloca() across RSP File I/O handlers (Fopen, Frename,
> Funlink, Fstat, Fsystem).  A malicious inferior or remote stub could
> send a crafted packet with a large path length, displacing the stack
> pointer by up to 2 GiB and potentially crashing the debugger.
> 
> remote_fileio_extract_ptr_w_len now rejects negative lengths, lengths
> that would overflow the int result (greater than INT_MAX), and zero.
> An allow_zero_length flag lets the Fsystem handler opt in to the zero
> length sentinel that signals a NULL cmdline query.  All other handlers
> use the default and are protected without any per call checks.  Oversized
> names are rejected naturally by the underlying syscall with ENAMETOOLONG.
> All alloca(length) calls have been replaced with
> gdb::unique_xmalloc_ptr<char>, so an oversized but positive length now
> fails as a graceful heap allocation error rather than corrupting the
> stack.
> 
> Add a selftest that exercises various problematic cases.
> 
> Signed-off-by: Luis Machado <luis.machado@amd.com>

Approved-By: Pedro Alves <pedro@palves.net>