[Bug python/16313] New: c_get_string does wrong thing for internal vars

["dje at google dot com" <sourceware-bugzilla at sourceware dot org>]

https://sourceware.org/bugzilla/show_bug.cgi?id=16313

            Bug ID: 16313
           Summary: c_get_string does wrong thing for internal vars
           Product: gdb
           Version: HEAD
            Status: NEW
          Severity: normal
          Priority: P2
         Component: python
          Assignee: unassigned at sourceware dot org
          Reporter: dje at google dot com

[filed under "python" as python is a client of this code, and I couldn't find a
better choice]

ref:
https://sourceware.org/ml/gdb-patches/2013-12/msg00104.html

Pedro writes:

BTW, it looks like the not_lval/lval_internalvar path can
blindly read beyond the value's contents buffer, if *length
is bigger than the value's contents buffer size:

  /* If the string lives in GDB's memory instead of the inferior's,
     then we just need to copy it to BUFFER.  Also, since such strings
     are arrays with known size, FETCHLIMIT will hold the size of the
     array.  */
  if ((VALUE_LVAL (value) == not_lval
       || VALUE_LVAL (value) == lval_internalvar)
      && fetchlimit != UINT_MAX)
    {
      int i;
      const gdb_byte *contents = value_contents (value);

      /* If a length is specified, use that.  */
      if (*length >= 0)
    i  = *length;
        ^^^^^^^^^^^^^
      else
     /* Otherwise, look for a null character.  */
     for (i = 0; i < fetchlimit; i++)
      if (extract_unsigned_integer (contents + i * width,
                    width, byte_order) == 0)
         break;

      /* I is now either a user-defined length, the number of non-null
      characters, or FETCHLIMIT.  */
      *length = i * width;
      *buffer = xmalloc (*length);
      memcpy (*buffer, contents, *length);
      ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

-- 
You are receiving this mail because:
You are on the CC list for the bug.