[PATCH] Return lazy value from allocate_repeat_value

[PATCH] Return lazy value from allocate_repeat_value

[Tom Tromey]

A user noticed that the "@" operator could cause a crash in gdb.  The
bug here was that value::allocate_contents might limit the amount of
memory allocated for the contents, but value_repeat did not respect
this.

This patch fixes the problem by having allocate_repeat_value return a
lazy value.  This defers to the memory reading to the "usual" code
that does respect these limits.

Regression tested on x86-64 Fedora 43.

Note that the new test only reliably fails in an ASAN build.

Bug: https://sourceware.org/bugzilla/show_bug.cgi?id=34132
---
 gdb/testsuite/gdb.base/printcmds.exp | 9 +++++++++
 gdb/valops.c                         | 4 ----
 gdb/value.c                          | 2 +-
 3 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/gdb/testsuite/gdb.base/printcmds.exp b/gdb/testsuite/gdb.base/printcmds.exp
index 12933d898ed..0600eaf2ab6 100644
--- a/gdb/testsuite/gdb.base/printcmds.exp
+++ b/gdb/testsuite/gdb.base/printcmds.exp
@@ -717,6 +717,15 @@ proc test_artificial_arrays {} {
 	{p int1dim[0]@TWO@three}
     gdb_test_escape_braces {p/x (short [])0x12345678} \
 	" = ({0x1234, 0x5678}|{0x5678, 0x1234})"
+
+    # A regression test for a buffer overflow.  PR gdb/34132.
+    gdb_test_no_output {set $ctable = (char *) ctable2}
+    gdb_test_no_output "set max-value-size 16"
+    gdb_test_no_output "set print elements 10"
+    gdb_test {print $ctable[0] @ 20} \
+	[quotemeta {$@DECIMAL = {97 'a', 88 'X' <repeats 15 times>...}}]
+    gdb_test_no_output "set max-value-size 65536"
+    gdb_test_no_output "set print elements 200"
 }
 
 proc test_print_char_arrays {} {
diff --git a/gdb/valops.c b/gdb/valops.c
index a235a0ebe8d..f9d83ce81f8 100644
--- a/gdb/valops.c
+++ b/gdb/valops.c
@@ -1387,10 +1387,6 @@ value_repeat (struct value *arg1, int count)
   val->set_lval (lval_memory);
   val->set_address (arg1->address ());
 
-  read_value_memory (val, 0, val->stack (), val->address (),
-		     val->contents_all_raw ().data (),
-		     type_length_units (val->enclosing_type ()));
-
   return val;
 }
 
diff --git a/gdb/value.c b/gdb/value.c
index d7c724757ce..6061d346dd5 100644
--- a/gdb/value.c
+++ b/gdb/value.c
@@ -1025,7 +1025,7 @@ allocate_repeat_value (struct type *type, int count)
   struct type *array_type
     = lookup_array_range_type (type, low_bound, count + low_bound - 1);
 
-  return value::allocate (array_type);
+  return value::allocate_lazy (array_type);
 }
 
 struct value *

base-commit: 3e5100fe3b15e2b3ece60f57b4c1ecc0c50cae53
-- 
2.55.0

Re: [PATCH] Return lazy value from allocate_repeat_value

[Simon Marchi]

On 9/21/26 12:16 PM, Tom Tromey wrote:
> A user noticed that the "@" operator could cause a crash in gdb.  The
> bug here was that value::allocate_contents might limit the amount of
> memory allocated for the contents, but value_repeat did not respect
> this.
> 
> This patch fixes the problem by having allocate_repeat_value return a
> lazy value.  This defers to the memory reading to the "usual" code
> that does respect these limits.
> 
> Regression tested on x86-64 Fedora 43.
> 
> Note that the new test only reliably fails in an ASAN build.
> 
> Bug: https://sourceware.org/bugzilla/show_bug.cgi?id=34132
> ---
>  gdb/testsuite/gdb.base/printcmds.exp | 9 +++++++++
>  gdb/valops.c                         | 4 ----
>  gdb/value.c                          | 2 +-
>  3 files changed, 10 insertions(+), 5 deletions(-)
> 
> diff --git a/gdb/testsuite/gdb.base/printcmds.exp b/gdb/testsuite/gdb.base/printcmds.exp
> index 12933d898ed..0600eaf2ab6 100644
> --- a/gdb/testsuite/gdb.base/printcmds.exp
> +++ b/gdb/testsuite/gdb.base/printcmds.exp
> @@ -717,6 +717,15 @@ proc test_artificial_arrays {} {
>  	{p int1dim[0]@TWO@three}
>      gdb_test_escape_braces {p/x (short [])0x12345678} \
>  	" = ({0x1234, 0x5678}|{0x5678, 0x1234})"
> +
> +    # A regression test for a buffer overflow.  PR gdb/34132.
> +    gdb_test_no_output {set $ctable = (char *) ctable2}

Just wondering, is the use of the convenience var necessary?

> +    gdb_test_no_output "set max-value-size 16"
> +    gdb_test_no_output "set print elements 10"
> +    gdb_test {print $ctable[0] @ 20} \
> +	[quotemeta {$@DECIMAL = {97 'a', 88 'X' <repeats 15 times>...}}]
> +    gdb_test_no_output "set max-value-size 65536"
> +    gdb_test_no_output "set print elements 200"

Can you do

  with max-value-size 16 -- with print elements 10 -- ...

to avoid having to set and reset the settings?

Other than that, LGTM.

Approved-By: Simon Marchi <simon.marchi@efficios.com>

Simon

Re: [PATCH] Return lazy value from allocate_repeat_value

[Tom Tromey]

>> +    # A regression test for a buffer overflow.  PR gdb/34132.
>> +    gdb_test_no_output {set $ctable = (char *) ctable2}

Simon> Just wondering, is the use of the convenience var necessary?

Doesn't seem to be, that was just a leftover from my various attempts to
reproduce the crash.

>> +    gdb_test_no_output "set max-value-size 16"
>> +    gdb_test_no_output "set print elements 10"
>> +    gdb_test {print $ctable[0] @ 20} \
>> +	[quotemeta {$@DECIMAL = {97 'a', 88 'X' <repeats 15 times>...}}]
>> +    gdb_test_no_output "set max-value-size 65536"
>> +    gdb_test_no_output "set print elements 200"

Simon> Can you do
Simon>   with max-value-size 16 -- with print elements 10 -- ...
Simon> to avoid having to set and reset the settings?

Yep.

Simon> Approved-By: Simon Marchi <simon.marchi@efficios.com>

Thanks.

Tom