[Ada] ada_unpack_from_contents: Error if target buffer not large enough

This adds a guard that the size of the "unpacked" buffer is large enough
to contain at least BIT_SIZE bits.  If not, report an error.  This is to
guard this routine from doing buffer overflows when called incorrectly.

gdb/ChangeLog:

        * ada-lang.c (ada_unpack_from_contents): Add guard that unpacked
        is large enough for BIT_SIZE.  Update function comment.

diff --git a/gdb/ChangeLog b/gdb/ChangeLog
index 45e04aeb46626c176dd088305f5ece76f2e5445e..578aeb86d30be28fbda7d54115bf4739ae6b9119 100644 (file)
--- a/gdb/ChangeLog
+++ b/gdb/ChangeLog
@@ -1,3 +1,8 @@
+2015-10-09  Joel Brobecker  <brobecker@adacore.com>
+
+       * ada-lang.c (ada_unpack_from_contents): Add guard that unpacked
+       is large enough for BIT_SIZE.  Update function comment.
+
 2015-10-09  Joel Brobecker  <brobecker@adacore.com>
 
        * ada-lang.c (ada_value_primitive_packed_val): Move

diff --git a/gdb/ada-lang.c b/gdb/ada-lang.c
index b7440e28820f977683086b1987e33843c8dc52b2..97f0c498b9aab23a9758ef0071bd5157b268f090 100644 (file)
--- a/gdb/ada-lang.c
+++ b/gdb/ada-lang.c
@@ -2383,9 +2383,12 @@ has_negatives (struct type *type)
 }
 
 /* With SRC being a buffer containing BIT_SIZE bits of data at BIT_OFFSET,
-   unpack that data into UNPACKED. UNPACKED_LEN is the size in bytes of
+   unpack that data into UNPACKED.  UNPACKED_LEN is the size in bytes of
    the unpacked buffer.
 
+   The size of the unpacked buffer (UNPACKED_LEN) is expected to be large
+   enough to contain at least BIT_OFFSET bits.  If not, an error is raised.
+
    IS_BIG_ENDIAN is nonzero if the data is stored in big endian mode,
    zero otherwise.
 
@@ -2417,6 +2420,12 @@ ada_unpack_from_contents (const gdb_byte *src, int bit_offset, int bit_size,
      the indices move.  */
   int delta = is_big_endian ? -1 : 1;
 
+  /* Make sure that unpacked is large enough to receive the BIT_SIZE
+     bits from SRC.  .*/
+  if ((bit_size + HOST_CHAR_BIT - 1) / HOST_CHAR_BIT > unpacked_len)
+    error (_("Cannot unpack %d bits into buffer of %d bytes"),
+          bit_size, unpacked_len);
+
   srcBitsLeft = bit_size;
   src_bytes_left = src_len;
   unpacked_bytes_left = unpacked_len;