FreeChainXenon/binutils-gdb
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Avoid buffer overflow in ada_decode

Browse source 
A bug report pointed out a buffer overflow in ada_decode, which Keith
helpfully analyzed.  ada_decode had a logic error when the input was
all digits.  While this isn't valid -- and would probably only appear
in fuzzer tests -- it still should be handled properly.

This patch adds a missing bounds check.  Tested with the self-tests in
an asan build.

Bug: https://sourceware.org/bugzilla/show_bug.cgi?id=30639
Reviewed-by: Keith Seitz <keiths@redhat.com>
This commit is contained in:
Tom Tromey 2023-08-16 11:29:19 -06:00
parent 94c5098e4d
commit 033bc52bb6
1 changed files with 18 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

19
gdb/ada-lang.c
View file

@ -57,6 +57,7 @@
#include "cli/cli-utils.h"
#include "gdbsupport/function-view.h"
#include "gdbsupport/byte-vector.h"
#include "gdbsupport/selftest.h"
#include <algorithm>
#include "ada-exp.h"
#include "charset.h"
@ -1377,7 +1378,7 @@ ada_decode (const char *encoded, bool wrap, bool operators)
i -= 1;
if (i > 1 && encoded[i] == '_' && encoded[i - 1] == '_')
len0 = i - 1;
else if (encoded[i] == '$')
else if (i >= 0 && encoded[i] == '$')
len0 = i;
}
@ -1574,6 +1575,18 @@ Suppress:
return decoded;
}
#ifdef GDB_SELF_TEST
static void
ada_decode_tests ()
{
/* This isn't valid, but used to cause a crash. PR gdb/30639. The
result does not really matter very much. */
SELF_CHECK (ada_decode ("44") == "44");
}
#endif
/* Table for keeping permanent unique copies of decoded names. Once
allocated, names in this table are never released. While this is a
storage leak, it should not be significant unless there are massive
@ -13984,4 +13997,8 @@ DWARF attribute."),
gdb::observers::new_objfile.attach (ada_new_objfile_observer, "ada-lang");
gdb::observers::free_objfile.attach (ada_free_objfile_observer, "ada-lang");
gdb::observers::inferior_exit.attach (ada_inferior_exit, "ada-lang");
#ifdef GDB_SELF_TEST
selftests::register_test ("ada-decode", ada_decode_tests);
#endif
}