From: Tom de Vries <tdevries@suse.de>
Date: Fri, 4 Dec 2020 21:35:07 +0000 (+0100)
Subject: [gdb] Fix heap-buffer-overflow in completion_tracker::build_completion_result
X-Git-Url: https://git.libre-soc.org/?a=commitdiff_plain;h=aafdfb4eddc3c58be24fe50a1e6543a4b9c8cbac;p=binutils-gdb.git

[gdb] Fix heap-buffer-overflow in completion_tracker::build_completion_result

When building gdb with address sanitizer and running test-case
gdb.base/completion.exp, we run into:
...
==5743==ERROR: AddressSanitizer: heap-buffer-overflow on address \
  0x60200025c02f at pc 0x000000cd9d64 bp 0x7fff3297da30 sp 0x7fff3297da28
READ of size 1 at 0x60200025c02f thread T0
    #0 0xcd9d63 in completion_tracker::build_completion_result(char const*, \
                     int, int) gdb/completer.c:2258
  ...
0x60200025c02f is located 1 bytes to the left of 1-byte region \
  [0x60200025c030,0x60200025c031)
...

This can be reproduced using just:
...
$ gdb
(gdb) p/d[TAB]
...

The problem is in this code in completion_tracker::build_completion_result:
...
      bool completion_suppress_append
        = (suppress_append_ws ()
           || match_list[0][strlen (match_list[0]) - 1] == ' ');
...
If strlen (match_list[0]) == 0, then we access match_list[0][-1].

Fix this by testing if the memory access is in bounds before doing the memory
access.

Tested on x86_64-linux.

gdb/ChangeLog:

2020-12-04  Tom de Vries  <tdevries@suse.de>

	PR gdb/27003
	* completer.c (completion_tracker::build_completion_result): Don't
	access match_list[0][-1].
---

diff --git a/gdb/ChangeLog b/gdb/ChangeLog
index eae761b7f12..b0c3bd62d01 100644
--- a/gdb/ChangeLog
+++ b/gdb/ChangeLog
@@ -1,3 +1,9 @@
+2020-12-04  Tom de Vries  <tdevries@suse.de>
+
+	PR gdb/27003
+	* completer.c (completion_tracker::build_completion_result): Don't
+	access match_list[0][-1].
+
 2020-12-04  Tom Tromey  <tromey@adacore.com>
 
 	* linespec.c (struct linespec_token): Rename; remove typedef.
diff --git a/gdb/completer.c b/gdb/completer.c
index 262c8556bf6..83b46a0e4d8 100644
--- a/gdb/completer.c
+++ b/gdb/completer.c
@@ -2253,9 +2253,11 @@ completion_tracker::build_completion_result (const char *text,
       /* If the tracker wants to, or we already have a space at the
 	 end of the match, tell readline to skip appending
 	 another.  */
+      char *match = match_list[0];
       bool completion_suppress_append
 	= (suppress_append_ws ()
-	   || match_list[0][strlen (match_list[0]) - 1] == ' ');
+	   || (match[0] != '\0'
+	       && match[strlen (match) - 1] == ' '));
 
       return completion_result (match_list, 1, completion_suppress_append);
     }