diff options
| author | Tom Tromey <tom@tromey.com> | 2018-08-18 14:51:46 -0600 |
|---|---|---|
| committer | Tom Tromey <tom@tromey.com> | 2018-10-03 15:19:06 -0600 |
| commit | 5e70ee0905a848701bb929a66f84ff2e212cfa81 (patch) | |
| tree | 4d059f190de82f740bff0eb9b77d5ddf0c38c454 /gdb/parse.c | |
| parent | 4dd1b46077b2ae7331f274f7888733de5166445c (diff) | |
| download | gdb-5e70ee0905a848701bb929a66f84ff2e212cfa81.zip gdb-5e70ee0905a848701bb929a66f84ff2e212cfa81.tar.gz gdb-5e70ee0905a848701bb929a66f84ff2e212cfa81.tar.bz2 | |
Avoid undefined behavior in ada_operator_length
-fsanitize=undefined pointed out this error:
runtime error: load of value 2887952, which is not a valid value for type 'exp_opcode'
This happens in gdb.ada/complete.exp when processing "complete p
my_glob". This does not parse, so the Ada parser throws an exception;
but then the code in parse_exp_in_context_1 accepts the expression
anyway. However, as no elements have been written to the expression,
undefined behavior results.
The fix is to notice this case in parse_exp_in_context_1. This patch
also adds an assertion to prefixify_expression to enforce this
pre-existing constraint.
gdb/ChangeLog
2018-10-03 Tom Tromey <tom@tromey.com>
* parse.c (prefixify_expression): Add assert.
(parse_exp_in_context_1): Throw exception if the expression is
empty.
Diffstat (limited to 'gdb/parse.c')
| -rw-r--r-- | gdb/parse.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/gdb/parse.c b/gdb/parse.c index 163852c..8a128a7 100644 --- a/gdb/parse.c +++ b/gdb/parse.c @@ -792,6 +792,7 @@ copy_name (struct stoken token) int prefixify_expression (struct expression *expr) { + gdb_assert (expr->nelts > 0); int len = sizeof (struct expression) + EXP_ELEM_TO_BYTES (expr->nelts); struct expression *temp; int inpos = expr->nelts, outpos = 0; @@ -1205,7 +1206,10 @@ parse_exp_in_context_1 (const char **stringptr, CORE_ADDR pc, } CATCH (except, RETURN_MASK_ALL) { - if (! parse_completion) + /* If parsing for completion, allow this to succeed; but if no + expression elements have been written, then there's nothing + to do, so fail. */ + if (! parse_completion || ps.expout_ptr == 0) throw_exception (except); } END_CATCH |