From 5e70ee0905a848701bb929a66f84ff2e212cfa81 Mon Sep 17 00:00:00 2001 From: Tom Tromey Date: Sat, 18 Aug 2018 14:51:46 -0600 Subject: [PATCH] Avoid undefined behavior in ada_operator_length -fsanitize=undefined pointed out this error: runtime error: load of value 2887952, which is not a valid value for type 'exp_opcode' This happens in gdb.ada/complete.exp when processing "complete p my_glob". This does not parse, so the Ada parser throws an exception; but then the code in parse_exp_in_context_1 accepts the expression anyway. However, as no elements have been written to the expression, undefined behavior results. The fix is to notice this case in parse_exp_in_context_1. This patch also adds an assertion to prefixify_expression to enforce this pre-existing constraint. gdb/ChangeLog 2018-10-03 Tom Tromey * parse.c (prefixify_expression): Add assert. (parse_exp_in_context_1): Throw exception if the expression is empty. --- gdb/ChangeLog | 8 +++++++- gdb/parse.c | 6 +++++- 2 files changed, 12 insertions(+), 2 deletions(-) diff --git a/gdb/ChangeLog b/gdb/ChangeLog index 9731c99a6a2..1a3cc6c30a2 100644 --- a/gdb/ChangeLog +++ b/gdb/ChangeLog @@ -1,3 +1,9 @@ +2018-10-03 Tom Tromey + + * parse.c (prefixify_expression): Add assert. + (parse_exp_in_context_1): Throw exception if the expression is + empty. + 2018-10-03 Tom Tromey * dwarf2read.c (read_signed_leb128): Work in ULONGEST. @@ -14219,7 +14225,7 @@ Update copyright year range in all GDB files. -2018-01-01 Joel Brobecker +2018-01-01, 18 Joel Brobecker * copyright.py (BY_HAND): Remove gdb/testsuite/gdb.base/step-line.inp and gdb/testsuite/gdb.base/step-line.c. diff --git a/gdb/parse.c b/gdb/parse.c index 163852cb84c..8a128a74d77 100644 --- a/gdb/parse.c +++ b/gdb/parse.c @@ -792,6 +792,7 @@ copy_name (struct stoken token) int prefixify_expression (struct expression *expr) { + gdb_assert (expr->nelts > 0); int len = sizeof (struct expression) + EXP_ELEM_TO_BYTES (expr->nelts); struct expression *temp; int inpos = expr->nelts, outpos = 0; @@ -1205,7 +1206,10 @@ parse_exp_in_context_1 (const char **stringptr, CORE_ADDR pc, } CATCH (except, RETURN_MASK_ALL) { - if (! parse_completion) + /* If parsing for completion, allow this to succeed; but if no + expression elements have been written, then there's nothing + to do, so fail. */ + if (! parse_completion || ps.expout_ptr == 0) throw_exception (except); } END_CATCH -- 2.30.2