From mboxrd@z Thu Jan  1 00:00:00 1970
From: Keith Seitz <keiths@cygnus.com>
To: gdb-patches@sources.redhat.com
Subject: [RFA2] Follow-up decode_line_1 crash
Date: Wed, 14 Mar 2001 08:28:00 -0000
Message-id: <Pine.SOL.3.91.1010314081443.2126G-100000@ryobi.cygnus.com>
X-SW-Source: 2001-03/msg00203.html

Problem:

$ gdb -nw -nx -q
(gdb) b "foo"
Segmentation fault (core dumped)

decode_linespec_1 does something like:

char *p = *argptr; (the first quote in "foo")
if (p == '"')
  {
    p++;
    is_quote_enclosed = 1;
  }

  if (is_quote_enclosed)
    {
      char *closing_quote = strchr (p, '"');
      if (closing_quote && closing_quote[1] == '\0')
	*closing_quote = '\0';
    }

/* so now p looks like foo with no quotes and *argptr is "foo */


char *copy = (char *) alloca (p - *argptr + 1); <-- alloca of 0 bytes
memcpy (copy, *argptr, p - *argptr); <-- copy -1 bytes
 
Patch:

Index: linespec.c
===================================================================
RCS file: /cvs/cvsfiles/devo/gdb/linespec.c,v
retrieving revision 2.4
diff -p -p -r2.4 linespec.c
*** linespec.c	2000/12/20 14:34:15	2.4
--- linespec.c	2001/03/14 16:16:11
*************** decode_line_1 (char **argptr, int funfir
*** 611,620 ****
  
    s = NULL;
    p = *argptr;
!   if (p[0] == '"')
      {
        is_quote_enclosed = 1;
!       p++;
      }
    else
      is_quote_enclosed = 0;
--- 611,620 ----
  
    s = NULL;
    p = *argptr;
!   if (**argptr == '"')
      {
        is_quote_enclosed = 1;
!       (*argptr)++;
      }
    else
      is_quote_enclosed = 0;

Tested on RH6.2. Should be generic enough to apply to all targets. I'm no 
expert at this stuff, but a crash is Just Plain Bad (TM).

Keith