Re: [PATCH] [gdb] Fix heap-buffer-overflow in args_complete_p

Tom de Vries
2026-01-06T09:30:26Z

On 1/6/26 9:47 AM, Tom de Vries wrote:
> and it's the fact that we don't check for '\0' after skip_spaces that is
> the problem.  I think it should be possible to reproduce the problem
> with args == " ".

I've written a unit test that reproduces the problem with args == " ".

Thanks,
- Tom

diff --git a/gdb/infcmd.c b/gdb/infcmd.c
index 1a7daf1461b..88948a343da 100644
--- a/gdb/infcmd.c
+++ b/gdb/infcmd.c
@@ -56,6 +56,7 @@
#include <optional>
#include "source.h"
#include "cli/cli-style.h"
+#include "gdbsupport/selftest.h"

/* Local functions: */

@@ -123,7 +124,7 @@ show_inferior_tty_command (struct ui_file *file, int
from_tty,
finished. */

static bool
-args_complete_p (const std::string &args)
+args_complete_p (const std::string &args, const char **end = nullptr)
{
const char *input = args.c_str ();
bool squote = false, dquote = false;
@@ -180,9 +185,28 @@ args_complete_p (const std::string &args)
++input;
}

+ if (end != nullptr)
+ *end = input;
return (!dquote && !squote);
}

+#if GDB_SELF_TEST
+namespace selftests {
+
+static void
+infcmd_args_complete_p_tests (void)
+{
+ const char *end;
+
+ /* Regression test for heap-buffer-overflow reported in PR33754. */
+ std::string s1 = " ";
+ SELF_CHECK (args_complete_p (s1, &end));
+ SELF_CHECK (end == s1.data () + s1.size ());
+}
+
+} /* namespace selftests */
+#endif /* GDB_SELF_TEST */
+
/* Build a complete inferior argument string (all arguments to pass to the
inferior) and return it. ARGS is the initial part of the inferior
arguments string, which might be the complete inferior arguments, in
@@ -3634,4 +3658,9 @@ Show whether `finish' prints the return value."),
nullptr,
nullptr,
show_print_finish,
&setprintlist, &showprintlist);
+
+#if GDB_SELF_TEST
+ selftests::register_test ("infcmd-args-complete-p",
+ selftests::infcmd_args_complete_p_tests);
+#endif
}