This is the mail archive of the
gdb-prs@sourceware.org
mailing list for the GDB project.
[Bug exp/10728] New: gdb 7.0 branch: infinite loop evaluating pointer difference w/o complete debug info
- From: "snyder at bnl dot gov" <sourceware-bugzilla at sourceware dot org>
- To: gdb-prs at sourceware dot org
- Date: 3 Oct 2009 03:16:42 -0000
- Subject: [Bug exp/10728] New: gdb 7.0 branch: infinite loop evaluating pointer difference w/o complete debug info
- Reply-to: sourceware-bugzilla at sourceware dot org
hi -
Running gdb from the head of the gdb_7_0-branch, i found that trying
to evaluate the difference between two pointers for which complete
debugging information is not available causes gdb to go into an
infinite loop.
Here's an example of how to reproduce this problem.
This was done using gcc 4.1.2 on a Scientific Linux 5.3 system.
Here are the sources:
-- x.h -------------------------------------
struct Y;
struct X
{
Y* y1;
Y* y2;
};
X* y();
-- x.cc ------------------------------------
#include "x.h"
int main()
{
X* x = y();
return 0;
}
-- y.cc ------------------------------------
#include "x.h"
struct Y{};
X* y()
{
static X xx;
static Y yy;
xx.y1 = &yy;
xx.y2 = xx.y1+1;
return &xx;
}
--------------------------------------------
Build like this:
$ g++ -c y.cc
$ g++ -g -o x x.cc y.o
Then run under the debugger:
$ .../gdb ./x
...
GNU gdb (GDB) 6.8.92.20091003-cvs
...
This GDB was configured as "x86_64-unknown-linux-gnu".
...
(gdb) break main
Breakpoint 1 at 0x400530: file x.cc, line 5.
(gdb) run
Starting program: /direct/usatlas+u/snyder/x
Breakpoint 1, main () at x.cc:5
5 X* x = y();
(gdb) n
6 return 0;
(gdb) p *x
$1 = {y1 = 0x600990, y2 = 0x600991}
(gdb) p x->y2-x->y1
At which point gdb goes into an infinite loop.
Attaching to the looping gdb gives this stack trace:
0x0000000000510fc4 in value_ptrdiff (arg1=0x7ba1840, arg2=0x7ba1a70)
at valarith.c:125
125 return (value_as_long (arg1) - value_as_long (arg2)) / sz;
(gdb) bt
#0 0x0000000000510fc4 in value_ptrdiff (arg1=0x7ba1840, arg2=0x7ba1a70)
at valarith.c:125
#1 0x000000000050793a in evaluate_subexp_standard (expect_type=0x0,
exp=0x7ba13a0, pos=0x7fff779a07fc, noside=EVAL_NORMAL) at eval.c:1802
#2 0x00000000005caa0f in evaluate_subexp_c (expect_type=0x0, exp=0x7ba13a0,
pos=0x7fff779a07fc, noside=EVAL_NORMAL) at c-lang.c:1038
#3 0x0000000000502cc7 in evaluate_subexp (expect_type=0x0, exp=0x7ba13a0,
pos=0x7fff779a07fc, noside=EVAL_NORMAL) at eval.c:73
#4 0x0000000000502e82 in evaluate_expression (exp=0x7ba13a0) at eval.c:163
#5 0x0000000000517fd9 in print_command_1 (exp=0x7a35102 "x->y2-x->y1",
inspect=0, voidprint=1) at ./printcmd.c:898
#6 0x0000000000518158 in print_command (exp=0x7a35102 "x->y2-x->y1",
from_tty=1) at ./printcmd.c:946
#7 0x00000000004aef74 in do_cfunc (c=0x7a6ff20, args=0x7a35102 "x->y2-x->y1",
from_tty=1) at ./cli/cli-decode.c:67
#8 0x00000000004b1e71 in cmd_func (cmd=0x7a6ff20,
args=0x7a35102 "x->y2-x->y1", from_tty=1) at ./cli/cli-decode.c:1738
...
In the expression here, sz is 0:
(gdb) p sz
$1 = 0
Trying to continue gives:
(gdb) c
Continuing.
Program received signal SIGFPE, Arithmetic exception.
0x0000000000510fc4 in value_ptrdiff (arg1=0x7ba1840, arg2=0x7ba1a70)
at valarith.c:125
125 return (value_as_long (arg1) - value_as_long (arg2)) / sz;
So we're endlessly trying to divide by zero.
I made this patch to protect against this.
2009-10-02 scott s snyder <snyder@bnl.gov>
* valarith.c (value_ptrdiff): sz can be zero if the target type of
the pointer is not complete. Protect against division by zero,
which will cause an infinite loop.
Index: valarith.c
===================================================================
RCS file: /cvs/src/src/gdb/valarith.c,v
retrieving revision 1.76
diff -u -p -r1.76 valarith.c
--- valarith.c 2 Jul 2009 17:25:59 -0000 1.76
+++ valarith.c 3 Oct 2009 02:59:13 -0000
@@ -122,6 +122,10 @@ First argument of `-' is a pointer and s
an integer nor a pointer of the same type."));
sz = TYPE_LENGTH (check_typedef (TYPE_TARGET_TYPE (type1)));
+ if (sz == 0) {
+ error (_("Cannot perform pointer math on incomplete types, "
+ "try casting to a known type, or void *."));
+ }
return (value_as_long (arg1) - value_as_long (arg2)) / sz;
}
--
Summary: gdb 7.0 branch: infinite loop evaluating pointer
difference w/o complete debug info
Product: gdb
Version: 6.8
Status: UNCONFIRMED
Severity: normal
Priority: P2
Component: exp
AssignedTo: unassigned at sourceware dot org
ReportedBy: snyder at bnl dot gov
CC: gdb-prs at sourceware dot org
GCC build triplet: x86_64-unknown-linux-gnu
GCC host triplet: x86_64-unknown-linux-gnu
GCC target triplet: x86_64-unknown-linux-gnu
http://sourceware.org/bugzilla/show_bug.cgi?id=10728
------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.