[PATCH] gdb: fix off-by-one error in quirk_rust_enum

[PATCH] gdb: fix off-by-one error in quirk_rust_enum

[Simon Marchi]

Found by inspection, so I don't have a test for it (I don't think it
would be easy to have this bug cause a failure reliably).

We allocate space for N fields into `new_fields`, then memcpy N fields
at `new_fields + 1`.  This overflows the allocated buffer by one field.

Fix it by allocating `N + 1` fields.

gdb/ChangeLog:

	* dwarf2/read.c (quirk_rust_enum): Allocate enough fields.
---
 gdb/dwarf2/read.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/gdb/dwarf2/read.c b/gdb/dwarf2/read.c
index 0c6182bbf3b9..2ab7c5c33131 100644
--- a/gdb/dwarf2/read.c
+++ b/gdb/dwarf2/read.c
@@ -9420,7 +9420,7 @@ quirk_rust_enum (struct type *type, struct objfile *objfile)
       /* Make space for the discriminant field.  */
       struct field *disr_field = &TYPE_FIELD (disr_type, 0);
       field *new_fields
-	= (struct field *) TYPE_ZALLOC (type, (TYPE_NFIELDS (type)
+	= (struct field *) TYPE_ZALLOC (type, ((TYPE_NFIELDS (type) + 1)
 					       * sizeof (struct field)));
       memcpy (new_fields + 1, TYPE_FIELDS (type),
 	      TYPE_NFIELDS (type) * sizeof (struct field));
-- 
2.26.2

Re: [PATCH] gdb: fix off-by-one error in quirk_rust_enum

[Tom Tromey]

>>>>> "Simon" == Simon Marchi via Gdb-patches <gdb-patches@sourceware.org> writes:

Simon> Found by inspection, so I don't have a test for it (I don't think it
Simon> would be easy to have this bug cause a failure reliably).

Simon> We allocate space for N fields into `new_fields`, then memcpy N fields
Simon> at `new_fields + 1`.  This overflows the allocated buffer by one field.

Simon> Fix it by allocating `N + 1` fields.

Simon> gdb/ChangeLog:

Simon> 	* dwarf2/read.c (quirk_rust_enum): Allocate enough fields.

Looks good.  Thank you.

Tom

Re: [PATCH] gdb: fix off-by-one error in quirk_rust_enum

[Simon Marchi]

On 2020-05-19 2:18 p.m., Tom Tromey wrote:
>>>>>> "Simon" == Simon Marchi via Gdb-patches <gdb-patches@sourceware.org> writes:
> 
> Simon> Found by inspection, so I don't have a test for it (I don't think it
> Simon> would be easy to have this bug cause a failure reliably).
> 
> Simon> We allocate space for N fields into `new_fields`, then memcpy N fields
> Simon> at `new_fields + 1`.  This overflows the allocated buffer by one field.
> 
> Simon> Fix it by allocating `N + 1` fields.
> 
> Simon> gdb/ChangeLog:
> 
> Simon> 	* dwarf2/read.c (quirk_rust_enum): Allocate enough fields.
> 
> Looks good.  Thank you.
> 
> Tom
> 

Thanks, pushed.

Simon