mirror of
https://sourceware.org/git/binutils-gdb.git
synced 2024-11-24 10:35:12 +08:00
cbfa858117
In tui_disasm_window::addr_is_displayed(), there can be situations
where "content" is empty. For instance, it can happen when the
"content" was not filled in tui_disasm_window::set_contents(),
because tui_disassemble() threw an exception. Usually this exception
is the result of fetching invalid PC addresses like the ones beyond
the end of the program.
Having "content.size ()" zero leads to an overflow in this condition
check inside tui_disasm_window::addr_is_displayed():
int i = 0;
while (i < content.size () - threshold ...) {
... content[i] ...
}
"threshold" is 2 and there are times that "content.size ()" is 0.
This results into an overflow and the loop is entered whereas it
should have been skipped. Finally, "content[i]" access leads to
a segmentation fault.
Same problem applies to tui_source_window::line_is_displayed().
The issue has been discussed at length in bug 25345:
https://sourceware.org/bugzilla/show_bug.cgi?id=25345
This commit avoids the segmentation faults with an early check:
if (content.size () < SCROLL_THRESHOLD)
return false;
Moreover, those functions have been overhauled to a leaner code.
gdb/ChangeLog:
2020-01-06 Shahab Vahedi <shahab@synopsys.com>
* tui/tui-disasm.c (tui_disasm_window::addr_is_displayed): Avoid
overflow by an early check of content vs threshold.
* tui/tui-source.c (tui_source_window::line_is_displayed):
Likewise.
|
||
|---|---|---|
| .. | ||
| ChangeLog-1998-2003 | ||
| tui-command.c | ||
| tui-command.h | ||
| tui-data.c | ||
| tui-data.h | ||
| tui-disasm.c | ||
| tui-disasm.h | ||
| tui-file.c | ||
| tui-file.h | ||
| tui-hooks.c | ||
| tui-hooks.h | ||
| tui-interp.c | ||
| tui-io.c | ||
| tui-io.h | ||
| tui-layout.c | ||
| tui-layout.h | ||
| tui-out.c | ||
| tui-out.h | ||
| tui-regs.c | ||
| tui-regs.h | ||
| tui-source.c | ||
| tui-source.h | ||
| tui-stack.c | ||
| tui-stack.h | ||
| tui-win.c | ||
| tui-win.h | ||
| tui-wingeneral.c | ||
| tui-wingeneral.h | ||
| tui-winsource.c | ||
| tui-winsource.h | ||
| tui.c | ||
| tui.h | ||