diff options
| author | Tom Tromey <tromey@adacore.com> | 2023-08-16 11:29:19 -0600 |
|---|---|---|
| committer | Tom Tromey <tromey@adacore.com> | 2023-08-16 13:07:08 -0600 |
| commit | 033bc52bb6190393c8eed80925fa78cc35b40c6d (patch) | |
| tree | c5894738d627d9d965265fffb0a61e246f373930 /gdb/ada-lang.c | |
| parent | 94c5098e4d9d5b58a6db31064398fb4941ab5efb (diff) | |
| download | binutils-033bc52bb6190393c8eed80925fa78cc35b40c6d.zip binutils-033bc52bb6190393c8eed80925fa78cc35b40c6d.tar.gz binutils-033bc52bb6190393c8eed80925fa78cc35b40c6d.tar.bz2 | |
Avoid buffer overflow in ada_decode
A bug report pointed out a buffer overflow in ada_decode, which Keith
helpfully analyzed. ada_decode had a logic error when the input was
all digits. While this isn't valid -- and would probably only appear
in fuzzer tests -- it still should be handled properly.
This patch adds a missing bounds check. Tested with the self-tests in
an asan build.
Bug: https://sourceware.org/bugzilla/show_bug.cgi?id=30639
Reviewed-by: Keith Seitz <keiths@redhat.com>
Diffstat (limited to 'gdb/ada-lang.c')
| -rw-r--r-- | gdb/ada-lang.c | 19 |
1 files changed, 18 insertions, 1 deletions
diff --git a/gdb/ada-lang.c b/gdb/ada-lang.c index 4a9a6e0..2f934b1 100644 --- a/gdb/ada-lang.c +++ b/gdb/ada-lang.c @@ -57,6 +57,7 @@ #include "cli/cli-utils.h" #include "gdbsupport/function-view.h" #include "gdbsupport/byte-vector.h" +#include "gdbsupport/selftest.h" #include <algorithm> #include "ada-exp.h" #include "charset.h" @@ -1377,7 +1378,7 @@ ada_decode (const char *encoded, bool wrap, bool operators) i -= 1; if (i > 1 && encoded[i] == '_' && encoded[i - 1] == '_') len0 = i - 1; - else if (encoded[i] == '$') + else if (i >= 0 && encoded[i] == '$') len0 = i; } @@ -1574,6 +1575,18 @@ Suppress: return decoded; } +#ifdef GDB_SELF_TEST + +static void +ada_decode_tests () +{ + /* This isn't valid, but used to cause a crash. PR gdb/30639. The + result does not really matter very much. */ + SELF_CHECK (ada_decode ("44") == "44"); +} + +#endif + /* Table for keeping permanent unique copies of decoded names. Once allocated, names in this table are never released. While this is a storage leak, it should not be significant unless there are massive @@ -13984,4 +13997,8 @@ DWARF attribute."), gdb::observers::new_objfile.attach (ada_new_objfile_observer, "ada-lang"); gdb::observers::free_objfile.attach (ada_free_objfile_observer, "ada-lang"); gdb::observers::inferior_exit.attach (ada_inferior_exit, "ada-lang"); + +#ifdef GDB_SELF_TEST + selftests::register_test ("ada-decode", ada_decode_tests); +#endif } |