Re: [PATCH] [gdb] Fix heap-buffer-overflow in args_complete_p

Tom Tromey
2026-01-05T20:10:09Z

>>>>> "Andrew" == Andrew Burgess <aburgess@redhat.com> writes:

Andrew> Sorry to be a bore, but after reading this commit, and the bug report,
Andrew> it's still not obvious to me where the overflow actually occurs.

I believe in this code:

if (*input == '\\' && strchr ("\"\\'", *(input + 1)) != nullptr)
++input;

if *input == '\\' but this is also the last character of the string,
then strchr will return the address of the \0, then ++input will advance
past it.

I think sticking "&& input[1] != '\0'" in there might be sufficient.

Though perhaps there's also an issue if the string ends with spaces,
because:

input = skip_spaces (input);
...
++input;

Tom