Re: [PATCH] [gdb-17-branch, gdb/stabs] Fix out-of-bounds write in read_member_functions

[Simon Marchi <simark@simark.ca>]

On 2026-09-02 05:05, Tom de Vries wrote:
>  gdb/stabsread.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/gdb/stabsread.c b/gdb/stabsread.c
> index 2d1411e9146..6cc3c5c7e02 100644
> --- a/gdb/stabsread.c
> +++ b/gdb/stabsread.c
> @@ -5112,6 +5112,7 @@ read_member_functions (struct stab_field_info *fip, const char **pp,
>  		{
>  		  if (!is_destructor_name (tmp_sublist->fn_field.physname))
>  		    {
> +		      last_sublist = tmp_sublist;
>  		      tmp_sublist = tmp_sublist->next;
>  		      continue;
>  		    }
> @@ -5122,7 +5123,6 @@ read_member_functions (struct stab_field_info *fip, const char **pp,
>  		    last_sublist->next = tmp_sublist->next;
>  		  else
>  		    sublist = tmp_sublist->next;
> -		  last_sublist = tmp_sublist;
>  		  tmp_sublist = tmp_sublist->next;
>  		}

LGTM.  last_sublist is meant to point to the last non-destructor
(non-filtetered-out) node.  The line you remove makes it point to a
destructor node, clearly wrong.

If this was for code in master, I would propose adding some comments,
like:

		  /* Unlink the destructor.  */
		  if (last_sublist)
		    {
		      /* Destructor is not the first element in linked list,
			 change preceding element's next to point to following
			 element.  */
		      last_sublist->next = tmp_sublist->next;
		    }
		  else
		    {
		      /* Destructor is the first element in linked list,
			 change head (SUBLIST) to point to following
			 element.  */
		      sublist = tmp_sublist->next;
		    }

(I wrote these comments locally to make sure I understood the code)

And also rename last_sublist to last_non_destructor_sublist.  And also
switch all this to not use a hand-crafted linked list.  But given that
this is for code on its way out, the two-liner fix is fine.

Approved-By: Simon Marchi <simon.marchi@efficios.com>

Simon