Skip to content

Commit 2123df0

Browse files
author
Yao Qi
committed
Fix array out of bound access
ASAN reports the following error, (gdb) PASS: gdb.fortran/vla-ptr-info.exp: continue to breakpoint: pvla-associated print &pvla^M =================================================================^M ^[[1m^[[31m==14331==ERROR: AddressSanitizer: global-buffer-overflow on address 0x000000ea569f at pc 0x0000008eb546 bp 0x7ffde0c1dc70 sp 0x7ffde0c1dc60^M ^[[1m^[[0m^[[1m^[[34mREAD of size 1 at 0x000000ea569f thread T0^[[1m^[[0m^M #0 0x8eb545 in f_print_type(type*, char const*, ui_file*, int, int, type_print_options const*) ../../binutils-gdb/gdb/f-typeprint.c:89^M #1 0xb611e2 in type_print(type*, char const*, ui_file*, int) ../../binutils-gdb/gdb/typeprint.c:365^M #2 0x7b3471 in c_value_print(value*, ui_file*, value_print_options const*) ../../binutils-gdb/gdb/c-valprint.c:650^M #3 0xb99517 in value_print(value*, ui_file*, value_print_options const*) ../../binutils-gdb/gdb/valprint.c:1233^M #4 0xa42be8 in print_formatted ../../binutils-gdb/gdb/printcmd.c:321^M #5 0xa46ac9 in print_value(value*, format_data const*) ../../binutils-gdb/gdb/printcmd.c:1233^M #6 0xa46d82 in print_command_1 ../../binutils-gdb/gdb/printcmd.c:1261^M #7 0xa46e3e in print_command ../../binutils-gdb/gdb/printcmd.c:1267 on this line of code demangled_args = varstring[strlen (varstring) - 1] == ')'; because varstring is an empty string and strlen () is 0, so "strlen () - 1" is definitely out of the bound of "varstring", (gdb) bt 10 at /home/yao/SourceCode/gnu/gdb/git/gdb/f-typeprint.c:56 at /home/yao/SourceCode/gnu/gdb/git/gdb/typeprint.c:365 at /home/yao/SourceCode/gnu/gdb/git/gdb/c-valprint.c:650 at /home/yao/SourceCode/gnu/gdb/git/gdb/valprint.c:1236 This patch adds a pre-check that varstring is empty or not. gdb: 2017-02-27 Yao Qi <yao.qi@linaro.org> * f-typeprint.c (f_print_type): Check "varstring" is empty first.
1 parent fbf25df commit 2123df0

File tree

2 files changed

+8
-2
lines changed

2 files changed

+8
-2
lines changed

gdb/ChangeLog

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
1+
2017-02-27 Yao Qi <yao.qi@linaro.org>
2+
3+
* f-typeprint.c (f_print_type): Check "varstring" is empty first.
4+
15
2017-02-26 Alan Hayward <alan.hayward@arm.com>
26

37
* regcache.c (regcache_raw_update): New function.

gdb/f-typeprint.c

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,6 @@ f_print_type (struct type *type, const char *varstring, struct ui_file *stream,
5252
int show, int level, const struct type_print_options *flags)
5353
{
5454
enum type_code code;
55-
int demangled_args;
5655

5756
if (type_not_associated (type))
5857
{
@@ -81,12 +80,15 @@ f_print_type (struct type *type, const char *varstring, struct ui_file *stream,
8180

8281
if (varstring != NULL)
8382
{
83+
int demangled_args;
84+
8485
fputs_filtered (varstring, stream);
8586

8687
/* For demangled function names, we have the arglist as part of the name,
8788
so don't print an additional pair of ()'s. */
8889

89-
demangled_args = varstring[strlen (varstring) - 1] == ')';
90+
demangled_args = (*varstring != '\0'
91+
&& varstring[strlen (varstring) - 1] == ')');
9092
f_type_print_varspec_suffix (type, stream, show, 0, demangled_args, 0);
9193
}
9294
}

0 commit comments

Comments
 (0)