From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 30797 invoked by alias); 25 Aug 2011 18:12:25 -0000 Received: (qmail 30787 invoked by uid 22791); 25 Aug 2011 18:12:24 -0000 X-SWARE-Spam-Status: No, hits=-7.1 required=5.0 tests=AWL,BAYES_00,RCVD_IN_DNSWL_HI,RP_MATCHES_RCVD,SPF_HELO_PASS,TW_GP X-Spam-Check-By: sourceware.org Received: from mx1.redhat.com (HELO mx1.redhat.com) (209.132.183.28) by sourceware.org (qpsmtpd/0.43rc1) with ESMTP; Thu, 25 Aug 2011 18:12:03 +0000 Received: from int-mx10.intmail.prod.int.phx2.redhat.com (int-mx10.intmail.prod.int.phx2.redhat.com [10.5.11.23]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id p7PIC3oT012847 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK) for ; Thu, 25 Aug 2011 14:12:03 -0400 Received: from ns3.rdu.redhat.com (ns3.rdu.redhat.com [10.11.255.199]) by int-mx10.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id p7PIC38B019713; Thu, 25 Aug 2011 14:12:03 -0400 Received: from barimba (ovpn01.gateway.prod.ext.phx2.redhat.com [10.5.9.1]) by ns3.rdu.redhat.com (8.13.8/8.13.8) with ESMTP id p7PIC1WV020746; Thu, 25 Aug 2011 14:12:02 -0400 From: Tom Tromey To: Aleksandar Ristovski Cc: gdb-patches@sources.redhat.com Subject: Re: [patch] buffer overflow in symtab_from_filename References: Date: Thu, 25 Aug 2011 18:12:00 -0000 In-Reply-To: (Aleksandar Ristovski's message of "Thu, 25 Aug 2011 13:46:09 -0400") Message-ID: User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.0.50 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain Mailing-List: contact gdb-patches-help@sourceware.org; run by ezmlm Precedence: bulk List-Id: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: gdb-patches-owner@sourceware.org X-SW-Source: 2011-08/txt/msg00472.txt.bz2 Aleksandar> In my case, I would get it by command "b main": on entry to Aleksandar> symtab_from_filename (called from decode_line_1, ln 879), Aleksandar> argptr points to a pointer to argument passed to 'break' Aleksandar> command; p (argument value on entry) points to the end of Aleksandar> the string ('\0'). Then this value is assigned to p1. I would have thought that lookup_symtab would return NULL here, causing the throw_error branch to be taken. I guess it could happen with 'break main.c'. Aleksandar> I think it is obvious enough to not warrant a separate test case? I agree. Patch is ok, please commit. Tom