mirrors/binutils-gdb
0
0
Fork 0
mirror of https://sourceware.org/git/binutils-gdb.git synced 2024-12-15 13:23:29 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

GDB SEGV while trying to print uninitialize variant record

Browse Source 
We have a variant record whose value is defined as follow:

   type Discriminant_Record (Num1, Num2,
                             Num3, Num4 : Natural) is record
      Field1 : My_Record_Array (1 .. Num2);
      Field2 : My_Record_Array (Num1 .. 10);
      Field3 : My_Record_Array (Num1 .. Num2);
      Field4 : My_Record_Array (Num3 .. Num2);
      Field5 : My_Record_Array (Num4 .. Num2);
   end record;
   Dire : Discriminant_Record (1, 7, 3, 0);

However, we're trying to print "Dire" before it is elaborated.
This is common if one breaks on a function and then starts doing
"info locals" for instance.

What happens is that GDB reads bogus values for fields Num1 to
Num4, and deduces a bogus (ginormouos) size for component
"Field1".  The length is so large that it then later causes
an overflow in the overall record length computation. Things
go downhill from there, because length(field1) > length(record).
So, when after we've fetched the value of the record based on
the computed size, we crash trying to access unallocated memory
when accessing field1...

The first fix we can do is to check the size of the field
against the maximum object size.  If it exceeds that size,
then we know the record will also exceed that size...

gdb/ChangeLog:

        * ada-lang.c (ada_template_to_fixed_record_type_1):
        For dynamic fields, check the field size against the maximum
        object size.
This commit is contained in:
Joel Brobecker 2010-11-23 01:07:22 +00:00
parent 1324a0d9b5
commit 27f2a97baf
2 changed files with 20 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
gdb/ChangeLog
View File

@ -1,3 +1,9 @@
2010-11-22 Joel Brobecker <brobecker@adacore.com>
* ada-lang.c (ada_template_to_fixed_record_type_1):
For dynamic fields, check the field size against the maximum
object size.
2010-11-22 Joel Brobecker <brobecker@adacore.com>
* mips-irix-tdep.c (mips_irix_n32_stack_tramp_frame_init): New

14
gdb/ada-lang.c
View File

@ -7122,9 +7122,23 @@ ada_template_to_fixed_record_type_1 (struct type *type,
field_type = ada_get_base_type (field_type);
field_type = ada_to_fixed_type (field_type, field_valaddr,
field_address, dval, 0);
/* If the field size is already larger than the maximum
object size, then the record itself will necessarily
be larger than the maximum object size. We need to make
this check now, because the size might be so ridiculously
large (due to an uninitialized variable in the inferior)
that it would cause an overflow when adding it to the
record size. */
check_size (field_type);
TYPE_FIELD_TYPE (rtype, f) = field_type;
TYPE_FIELD_NAME (rtype, f) = TYPE_FIELD_NAME (type, f);
/* The multiplication can potentially overflow. But because
the field length has been size-checked just above, and
assuming that the maximum size is a reasonable value,
an overflow should not happen in practice. So rather than
adding overflow recovery code to this already complex code,
we just assume that it's not going to happen. */
bit_incr = fld_bit_len =
TYPE_LENGTH (TYPE_FIELD_TYPE (rtype, f)) * TARGET_CHAR_BIT;
}