From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 11434 invoked by alias); 17 May 2010 16:07:02 -0000 Received: (qmail 11411 invoked by uid 22791); 17 May 2010 16:06:58 -0000 X-SWARE-Spam-Status: No, hits=-5.6 required=5.0 tests=AWL,BAYES_00,RCVD_IN_DNSWL_HI,SPF_HELO_PASS,T_RP_MATCHES_RCVD X-Spam-Check-By: sourceware.org Received: from mx1.redhat.com (HELO mx1.redhat.com) (209.132.183.28) by sourceware.org (qpsmtpd/0.43rc1) with ESMTP; Mon, 17 May 2010 16:06:49 +0000 Received: from int-mx08.intmail.prod.int.phx2.redhat.com (int-mx08.intmail.prod.int.phx2.redhat.com [10.5.11.21]) by mx1.redhat.com (8.13.8/8.13.8) with ESMTP id o4HG6lUj001241 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK) for ; Mon, 17 May 2010 12:06:47 -0400 Received: from hase.home (ovpn01.gateway.prod.ext.phx2.redhat.com [10.5.9.1]) by int-mx08.intmail.prod.int.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id o4HG6j8v012350 for ; Mon, 17 May 2010 12:06:46 -0400 From: Andreas Schwab To: gdb-patches@sourceware.org Subject: [PATCH] PR gdb/11092: Fix index overflow X-Yow: Being a BALD HERO is almost as FESTIVE as a TATTOOED KNOCKWURST. Date: Mon, 17 May 2010 16:10:00 -0000 Message-ID: User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/23.1 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Mailing-List: contact gdb-patches-help@sourceware.org; run by ezmlm Precedence: bulk List-Id: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: gdb-patches-owner@sourceware.org X-SW-Source: 2010-05/txt/msg00350.txt.bz2 The length parameter of c_printstr can be -1 meaning NUL terminated. Compute real length before its first use as an index. Andreas. 2010-05-17 Andreas Schwab PR gdb/11092 * c-lang.c (c_printstr): Compute real length of NUL terminated string at first. Index: c-lang.c =================================================================== RCS file: /cvs/src/src/gdb/c-lang.c,v retrieving revision 1.85 diff -a -u -p -a -u -p -r1.85 c-lang.c --- c-lang.c 13 May 2010 23:53:32 -0000 1.85 +++ c-lang.c 17 May 2010 15:58:18 -0000 @@ -390,6 +390,19 @@ c_printstr (struct ui_file *stream, stru int finished = 0; int need_escape = 0; + if (length == -1) + { + unsigned long current_char = 1; + + for (i = 0; current_char; ++i) + { + QUIT; + current_char = extract_unsigned_integer (string + i * width, + width, byte_order); + } + length = i; + } + /* If the string was not truncated due to `set print elements', and the last byte of it is a null, we don't print that, in traditional C style. */ @@ -424,19 +437,6 @@ c_printstr (struct ui_file *stream, stru return; } - if (length == -1) - { - unsigned long current_char = 1; - - for (i = 0; current_char; ++i) - { - QUIT; - current_char = extract_unsigned_integer (string + i * width, - width, byte_order); - } - length = i; - } - /* Arrange to iterate over the characters, in wchar_t form. */ iter = make_wchar_iterator (string, length * width, encoding, width); cleanup = make_cleanup_wchar_iterator (iter); -- Andreas Schwab, schwab@redhat.com GPG Key fingerprint = D4E8 DBE3 3813 BB5D FA84 5EC7 45C6 250E 6F00 984E "And now for something completely different."