72 lines
2.2 KiB
Diff
72 lines
2.2 KiB
Diff
From c2596d1409817bc590f0f95f6a4b952f37198001 Mon Sep 17 00:00:00 2001
|
|
From: liningjie <liningjie@xfusion.com>
|
|
Date: Fri, 28 Jul 2023 13:25:11 +0800
|
|
Subject: [PATCH] Avoid buffer overflow in ada_decode
|
|
|
|
A bug report pointed out a buffer overflow in ada_decode, which Keith
|
|
helpfully analyzed. ada_decode had a logic error when the input was
|
|
all digits. While this isn't valid -- and would probably only appear
|
|
in fuzzer tests -- it still should be handled properly.
|
|
|
|
This patch adds a missing bounds check. Tested with the self-tests in
|
|
an asan build.
|
|
|
|
Bug: https://sourceware.org/bugzilla/show_bug.cgi?id=30639
|
|
Reviewed-by: Keith Seitz <keiths@redhat.com>
|
|
---
|
|
gdb/ada-lang.c | 19 ++++++++++++++++++-
|
|
1 file changed, 18 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/gdb/ada-lang.c b/gdb/ada-lang.c
|
|
index b098991..841901f 100644
|
|
--- a/gdb/ada-lang.c
|
|
+++ b/gdb/ada-lang.c
|
|
@@ -57,6 +57,7 @@
|
|
#include "cli/cli-utils.h"
|
|
#include "gdbsupport/function-view.h"
|
|
#include "gdbsupport/byte-vector.h"
|
|
+#include "gdbsupport/selftest.h"
|
|
#include <algorithm>
|
|
#include "ada-exp.h"
|
|
|
|
@@ -1057,7 +1058,7 @@ ada_decode (const char *encoded, bool wrap)
|
|
i -= 1;
|
|
if (i > 1 && encoded[i] == '_' && encoded[i - 1] == '_')
|
|
len0 = i - 1;
|
|
- else if (encoded[i] == '$')
|
|
+ else if (i >= 0 && encoded[i] == '$')
|
|
len0 = i;
|
|
}
|
|
|
|
@@ -1225,6 +1226,18 @@ ada_decode (const char *encoded, bool wrap)
|
|
return decoded;
|
|
}
|
|
|
|
+#ifdef GDB_SELF_TEST
|
|
+
|
|
+static void
|
|
+ada_decode_tests ()
|
|
+{
|
|
+ /* This isn't valid, but used to cause a crash. PR gdb/30639. The
|
|
+ result does not really matter very much. */
|
|
+ SELF_CHECK (ada_decode ("44") == "44");
|
|
+}
|
|
+
|
|
+#endif
|
|
+
|
|
/* Table for keeping permanent unique copies of decoded names. Once
|
|
allocated, names in this table are never released. While this is a
|
|
storage leak, it should not be significant unless there are massive
|
|
@@ -13497,4 +13510,8 @@ DWARF attribute."),
|
|
gdb::observers::new_objfile.attach (ada_new_objfile_observer, "ada-lang");
|
|
gdb::observers::free_objfile.attach (ada_free_objfile_observer, "ada-lang");
|
|
gdb::observers::inferior_exit.attach (ada_inferior_exit, "ada-lang");
|
|
+
|
|
+#ifdef GDB_SELF_TEST
|
|
+ selftests::register_test ("ada-decode", ada_decode_tests);
|
|
+#endif
|
|
}
|
|
--
|
|
2.33.0
|
|
|