Re: [PATCH] [gdb] Fix heap-buffer-overflow in args_complete_p

[Tom de Vries <tdevries@suse.de>]

On 1/6/26 9:47 AM, Tom de Vries wrote:
> and it's the fact that we don't check for '\0' after skip_spaces that is 
> the problem.  I think it should be possible to reproduce the problem 
> with args == " ".

I've written a unit test that reproduces the problem with args == " ".

Thanks,
- Tom

diff --git a/gdb/infcmd.c b/gdb/infcmd.c
index 1a7daf1461b..88948a343da 100644
--- a/gdb/infcmd.c
+++ b/gdb/infcmd.c
@@ -56,6 +56,7 @@
  #include <optional>
  #include "source.h"
  #include "cli/cli-style.h"
+#include "gdbsupport/selftest.h"

  /* Local functions: */

@@ -123,7 +124,7 @@ show_inferior_tty_command (struct ui_file *file, int 
from_tty,
     finished.  */

  static bool
-args_complete_p (const std::string &args)
+args_complete_p (const std::string &args, const char **end = nullptr)
  {
    const char *input = args.c_str ();
    bool squote = false, dquote = false;
@@ -180,9 +185,28 @@ args_complete_p (const std::string &args)
        ++input;
      }

+  if (end != nullptr)
+    *end = input;
    return (!dquote && !squote);
  }

+#if GDB_SELF_TEST
+namespace selftests {
+
+static void
+infcmd_args_complete_p_tests (void)
+{
+  const char *end;
+
+  /* Regression test for heap-buffer-overflow reported in PR33754.  */
+  std::string s1 = " ";
+  SELF_CHECK (args_complete_p (s1, &end));
+  SELF_CHECK (end == s1.data () + s1.size ());
+}
+
+} /* namespace selftests */
+#endif /* GDB_SELF_TEST */
+
  /* Build a complete inferior argument string (all arguments to pass to the
     inferior) and return it.  ARGS is the initial part of the inferior
     arguments string, which might be the complete inferior arguments, in
@@ -3634,4 +3658,9 @@ Show whether `finish' prints the return value."), 
nullptr,
  			   nullptr,
  			   show_print_finish,
  			   &setprintlist, &showprintlist);
+
+#if GDB_SELF_TEST
+  selftests::register_test ("infcmd-args-complete-p",
+			    selftests::infcmd_args_complete_p_tests);
+#endif
  }