[PATCH] gdb: Check DW_OP_deref_type size against type

[PATCH] gdb: Check DW_OP_deref_type size against type

[Jielun Wu]

DWARF v5 requires the explicit size operand of DW_OP_deref_type to
match the size of the referenced base type.  The evaluator currently
passes both sizes to dwarf_expr_context::deref without validating the
encoding, and the generic dereference helper accepts the mismatch by
zero-extending the bytes read from memory.

Reject a mismatch after resolving the base type.  Add a DWARF assembler
test covering both DW_OP_deref_type and DW_OP_GNU_deref_type.

Tested on x86_64-linux.

Bug: https://sourceware.org/bugzilla/show_bug.cgi?id=34277
Signed-off-by: Jielun Wu <firmiana402@gmail.com>
---
 gdb/dwarf2/expr.c                             |  3 +
 .../gdb.dwarf2/dw2-deref-type-size.exp        | 78 +++++++++++++++++++
 2 files changed, 81 insertions(+)
 create mode 100644 gdb/testsuite/gdb.dwarf2/dw2-deref-type-size.exp

diff --git a/gdb/dwarf2/expr.c b/gdb/dwarf2/expr.c
index 3a6b8f58199..ff23fb3e891 100644
--- a/gdb/dwarf2/expr.c
+++ b/gdb/dwarf2/expr.c
@@ -2027,6 +2027,9 @@ dwarf_expr_context::execute_stack_op (gdb::array_view<const gdb_byte> expr)
 		op_ptr = safe_read_uleb128 (op_ptr, op_end, &uoffset);
 		cu_offset type_die_cu_off = (cu_offset) uoffset;
 		type = get_base_type (type_die_cu_off);
+		if (type->length () != addr_size)
+		  error (_("DW_OP_deref_type has different sizes for type and "
+			   "data"));
 	      }
 	    else
 	      type = address_type;
diff --git a/gdb/testsuite/gdb.dwarf2/dw2-deref-type-size.exp b/gdb/testsuite/gdb.dwarf2/dw2-deref-type-size.exp
new file mode 100644
index 00000000000..52eae9e9eae
--- /dev/null
+++ b/gdb/testsuite/gdb.dwarf2/dw2-deref-type-size.exp
@@ -0,0 +1,78 @@
+# Copyright 2026 Free Software Foundation, Inc.
+
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# Test that DW_OP_deref_type rejects an explicit dereference size that
+# differs from the size of the referenced base type.
+
+load_lib dwarf.exp
+
+require dwarf2_support
+
+standard_testfile main.c -dw.S
+
+set asm_file [standard_output_file $srcfile2]
+
+Dwarf::assemble $asm_file {
+    cu {version 5} {
+	compile_unit {} {
+	    declare_labels uint64_label
+
+	    uint64_label: base_type {
+		DW_AT_name "uint64_t"
+		DW_AT_encoding @DW_ATE_unsigned
+		DW_AT_byte_size 8 DW_FORM_sdata
+	    }
+
+	    foreach {var op} {
+		bad_deref_type DW_OP_deref_type
+		bad_gnu_deref_type DW_OP_GNU_deref_type
+	    } {
+		DW_TAG_variable {
+		    DW_AT_name $var
+		    DW_AT_type :$uint64_label
+		    DW_AT_external 1 DW_FORM_flag
+		    DW_AT_location {
+			variable _constants
+			variable _cu_label
+
+			DW_OP_addr main_label
+			_op .byte $_constants($op) $op
+			_op .byte 4 "dereference size"
+			_op .uleb128 "$uint64_label - $_cu_label" \
+			    "base type DIE offset"
+			DW_OP_stack_value
+		    } SPECIAL_expr
+		}
+	    }
+	}
+    }
+}
+
+if {[prepare_for_testing "failed to prepare" ${testfile} \
+	 [list $srcfile $asm_file] nodebug]} {
+    return
+}
+
+if {![runto_main]} {
+    return
+}
+
+foreach_with_prefix var {
+    bad_deref_type
+    bad_gnu_deref_type
+} {
+    gdb_test "print $var" \
+	"DW_OP_deref_type has different sizes for type and data"
+}
-- 
2.34.1

Re: [PATCH] gdb: Check DW_OP_deref_type size against type

[Keith Seitz]

Hi,

On 8/14/26 1:53 AM, Jielun Wu wrote:
> DWARF v5 requires the explicit size operand of DW_OP_deref_type to
> match the size of the referenced base type.  The evaluator currently
> passes both sizes to dwarf_expr_context::deref without validating the
> encoding, and the generic dereference helper accepts the mismatch by
> zero-extending the bytes read from memory.
> 
> Reject a mismatch after resolving the base type.  Add a DWARF assembler
> test covering both DW_OP_deref_type and DW_OP_GNU_deref_type.

This looks good to me and is consistent with how DW_OP_const_type
handles the identical scenario. Thank you very much for the test.
That is very appreciated.

Reviewed-By: Keith Seitz <keiths@redhat.com>

Thank you for the patch!

Keith

> Tested on x86_64-linux.
> 
> Bug: https://sourceware.org/bugzilla/show_bug.cgi?id=34277
> Signed-off-by: Jielun Wu <firmiana402@gmail.com>
> ---
>   gdb/dwarf2/expr.c                             |  3 +
>   .../gdb.dwarf2/dw2-deref-type-size.exp        | 78 +++++++++++++++++++
>   2 files changed, 81 insertions(+)
>   create mode 100644 gdb/testsuite/gdb.dwarf2/dw2-deref-type-size.exp
> 
> diff --git a/gdb/dwarf2/expr.c b/gdb/dwarf2/expr.c
> index 3a6b8f58199..ff23fb3e891 100644
> --- a/gdb/dwarf2/expr.c
> +++ b/gdb/dwarf2/expr.c
> @@ -2027,6 +2027,9 @@ dwarf_expr_context::execute_stack_op (gdb::array_view<const gdb_byte> expr)
>   		op_ptr = safe_read_uleb128 (op_ptr, op_end, &uoffset);
>   		cu_offset type_die_cu_off = (cu_offset) uoffset;
>   		type = get_base_type (type_die_cu_off);
> +		if (type->length () != addr_size)
> +		  error (_("DW_OP_deref_type has different sizes for type and "
> +			   "data"));
>   	      }
>   	    else
>   	      type = address_type;
> diff --git a/gdb/testsuite/gdb.dwarf2/dw2-deref-type-size.exp b/gdb/testsuite/gdb.dwarf2/dw2-deref-type-size.exp
> new file mode 100644
> index 00000000000..52eae9e9eae
> --- /dev/null
> +++ b/gdb/testsuite/gdb.dwarf2/dw2-deref-type-size.exp
> @@ -0,0 +1,78 @@
> +# Copyright 2026 Free Software Foundation, Inc.
> +
> +# This program is free software; you can redistribute it and/or modify
> +# it under the terms of the GNU General Public License as published by
> +# the Free Software Foundation; either version 3 of the License, or
> +# (at your option) any later version.
> +#
> +# This program is distributed in the hope that it will be useful,
> +# but WITHOUT ANY WARRANTY; without even the implied warranty of
> +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
> +# GNU General Public License for more details.
> +#
> +# You should have received a copy of the GNU General Public License
> +# along with this program.  If not, see <http://www.gnu.org/licenses/>.
> +
> +# Test that DW_OP_deref_type rejects an explicit dereference size that
> +# differs from the size of the referenced base type.
> +
> +load_lib dwarf.exp
> +
> +require dwarf2_support
> +
> +standard_testfile main.c -dw.S
> +
> +set asm_file [standard_output_file $srcfile2]
> +
> +Dwarf::assemble $asm_file {
> +    cu {version 5} {
> +	compile_unit {} {
> +	    declare_labels uint64_label
> +
> +	    uint64_label: base_type {
> +		DW_AT_name "uint64_t"
> +		DW_AT_encoding @DW_ATE_unsigned
> +		DW_AT_byte_size 8 DW_FORM_sdata
> +	    }
> +
> +	    foreach {var op} {
> +		bad_deref_type DW_OP_deref_type
> +		bad_gnu_deref_type DW_OP_GNU_deref_type
> +	    } {
> +		DW_TAG_variable {
> +		    DW_AT_name $var
> +		    DW_AT_type :$uint64_label
> +		    DW_AT_external 1 DW_FORM_flag
> +		    DW_AT_location {
> +			variable _constants
> +			variable _cu_label
> +
> +			DW_OP_addr main_label
> +			_op .byte $_constants($op) $op
> +			_op .byte 4 "dereference size"
> +			_op .uleb128 "$uint64_label - $_cu_label" \
> +			    "base type DIE offset"
> +			DW_OP_stack_value
> +		    } SPECIAL_expr
> +		}
> +	    }
> +	}
> +    }
> +}
> +
> +if {[prepare_for_testing "failed to prepare" ${testfile} \
> +	 [list $srcfile $asm_file] nodebug]} {
> +    return
> +}
> +
> +if {![runto_main]} {
> +    return
> +}
> +
> +foreach_with_prefix var {
> +    bad_deref_type
> +    bad_gnu_deref_type
> +} {
> +    gdb_test "print $var" \
> +	"DW_OP_deref_type has different sizes for type and data"
> +}

Re: [PATCH] gdb: Check DW_OP_deref_type size against type

[Simon Marchi]

On 8/14/26 4:53 AM, Jielun Wu wrote:
> DWARF v5 requires the explicit size operand of DW_OP_deref_type to
> match the size of the referenced base type.  The evaluator currently
> passes both sizes to dwarf_expr_context::deref without validating the
> encoding, and the generic dereference helper accepts the mismatch by
> zero-extending the bytes read from memory.
> 
> Reject a mismatch after resolving the base type.  Add a DWARF assembler
> test covering both DW_OP_deref_type and DW_OP_GNU_deref_type.
> 
> Tested on x86_64-linux.
> 
> Bug: https://sourceware.org/bugzilla/show_bug.cgi?id=34277
> Signed-off-by: Jielun Wu <firmiana402@gmail.com>
> ---
>  gdb/dwarf2/expr.c                             |  3 +
>  .../gdb.dwarf2/dw2-deref-type-size.exp        | 78 +++++++++++++++++++
>  2 files changed, 81 insertions(+)
>  create mode 100644 gdb/testsuite/gdb.dwarf2/dw2-deref-type-size.exp
> 
> diff --git a/gdb/dwarf2/expr.c b/gdb/dwarf2/expr.c
> index 3a6b8f58199..ff23fb3e891 100644
> --- a/gdb/dwarf2/expr.c
> +++ b/gdb/dwarf2/expr.c
> @@ -2027,6 +2027,9 @@ dwarf_expr_context::execute_stack_op (gdb::array_view<const gdb_byte> expr)
>  		op_ptr = safe_read_uleb128 (op_ptr, op_end, &uoffset);
>  		cu_offset type_die_cu_off = (cu_offset) uoffset;
>  		type = get_base_type (type_die_cu_off);
> +		if (type->length () != addr_size)
> +		  error (_("DW_OP_deref_type has different sizes for type and "
> +			   "data"));

I think the error message could be clearer, "type" and "data" are very
vague.  Ideally, we would print the actual op used (DW_OP_deref_type vs
DW_OP_GNU_deref_type), since they don't have the same encoding.
We could also at least print the sizes involved, that could help someone
figure out what is wrong.  Suggestion:


                if (type->length () != addr_size)
                  error (_("%s has dereference size %d, but its "
                           "type has size %s"),
                         get_DW_OP_name (op), addr_size,
                         pulongest (type->length ()));

Orthogonal to your change: the addr_size variable seems misnamed, nothing
says that the value we are accessing is an address.

> +Dwarf::assemble $asm_file {
> +    cu {version 5} {
> +	compile_unit {} {
> +	    declare_labels uint64_label
> +
> +	    uint64_label: base_type {
> +		DW_AT_name "uint64_t"
> +		DW_AT_encoding @DW_ATE_unsigned
> +		DW_AT_byte_size 8 DW_FORM_sdata
> +	    }
> +
> +	    foreach {var op} {
> +		bad_deref_type DW_OP_deref_type
> +		bad_gnu_deref_type DW_OP_GNU_deref_type
> +	    } {
> +		DW_TAG_variable {
> +		    DW_AT_name $var
> +		    DW_AT_type :$uint64_label
> +		    DW_AT_external 1 DW_FORM_flag
> +		    DW_AT_location {
> +			variable _constants
> +			variable _cu_label
> +
> +			DW_OP_addr main_label
> +			_op .byte $_constants($op) $op
> +			_op .byte 4 "dereference size"
> +			_op .uleb128 "$uint64_label - $_cu_label" \
> +			    "base type DIE offset"

Instead of emitting the bytes in-line here, could you please add the
necessary "_handle_DW_OP_*" procs to lib/dwarf.exp?

> +			DW_OP_stack_value
> +		    } SPECIAL_expr
> +		}
> +	    }
> +	}
> +    }
> +}
> +
> +if {[prepare_for_testing "failed to prepare" ${testfile} \
> +	 [list $srcfile $asm_file] nodebug]} {
> +    return
> +}
> +
> +if {![runto_main]} {
> +    return
> +}
> +
> +foreach_with_prefix var {
> +    bad_deref_type
> +    bad_gnu_deref_type
> +} {
> +    gdb_test "print $var" \
> +	"DW_OP_deref_type has different sizes for type and data"
> +}

Could you add some tests where the access works?  It doesn't seem like
we have coverage for that in the testsuite (at least for DWARF
assembler-based tests).

Simon

Re: [PATCH] gdb: Check DW_OP_deref_type size against type

[Tom Tromey]

>>>>> Jielun Wu <firmiana402@gmail.com> writes:

> DWARF v5 requires the explicit size operand of DW_OP_deref_type to
> match the size of the referenced base type.  The evaluator currently
> passes both sizes to dwarf_expr_context::deref without validating the
> encoding, and the generic dereference helper accepts the mismatch by
> zero-extending the bytes read from memory.

> Reject a mismatch after resolving the base type.  Add a DWARF assembler
> test covering both DW_OP_deref_type and DW_OP_GNU_deref_type.

> Tested on x86_64-linux.

I think we're going to need copyright assignments in order to merge this
and the other patches.

You can email 'assign@gnu.org' to get started.

Tom

Re: [PATCH] gdb: Check DW_OP_deref_type size against type

[JIELUN WU]

[-- Attachment #1: Type: text/plain, Size: 1080 bytes --]


On 2026/8/22 3:26, Tom Tromey wrote:
>>>>>> Jielun Wu<firmiana402@gmail.com> writes:
>> DWARF v5 requires the explicit size operand of DW_OP_deref_type to
>> match the size of the referenced base type.  The evaluator currently
>> passes both sizes to dwarf_expr_context::deref without validating the
>> encoding, and the generic dereference helper accepts the mismatch by
>> zero-extending the bytes read from memory.
>> Reject a mismatch after resolving the base type.  Add a DWARF assembler
>> test covering both DW_OP_deref_type and DW_OP_GNU_deref_type.
>> Tested on x86_64-linux.
> I think we're going to need copyright assignments in order to merge this
> and the other patches.
>
> You can email 'assign@gnu.org' to get started.
>
> Tom


Hi Tom,

Thanks for checking. I believe my copyright assignment has already been
completed and should be on file. I started the process in late June and
received the final confirmation email in early August.

Please let me know if it is not showing up in the records, or if you need
any additional information from me.

Best,
Jielun

[-- Attachment #2: Type: text/html, Size: 2566 bytes --]