[PATCH] Don't call strchr with the NULL character.

["Andrew Burgess" <aburgess at broadcom dot com>]

In the printf code we call strchr without guarding against the
case where the second parameter is NULL.

My local manpage for strchr doesn't say what happens in this case,
but this file:  src/libiberty/strchr.c
suggests the results are undefined, and indeed, the answer I see is
not NULL (which is what I might have hoped for).

Patch below adds check for NULL character, and some tests which are
currently failing for me, but as it's string overflow, the results 
are going to be undefined.

OK to apply?

Thanks,
Andrew

gdb/ChangeLog

	* common/format.c (parse_format_string): Add checks for NULL
	character before calling strchr.


gdb/testsuite/ChangeLog

	* gdb.base/printcmds.exp (test_printf): Add tests for format
	strings with missing format specifier.


diff --git a/gdb/common/format.c b/gdb/common/format.c
index 5803818..1bdd253 100644
--- a/gdb/common/format.c
+++ b/gdb/common/format.c
@@ -156,7 +156,7 @@ parse_format_string (const char **arg)
 
 	/* The first part of a format specifier is a set of flag
 	   characters.  */
-	while (strchr ("0-+ #", *f))
+	while (*f != '\0' && strchr ("0-+ #", *f))
 	  {
 	    if (*f == '#')
 	      seen_hash = 1;
@@ -170,7 +170,7 @@ parse_format_string (const char **arg)
 	  }
 
 	/* The next part of a format specifier is a width.  */
-	while (strchr ("0123456789", *f))
+	while (*f != '\0' && strchr ("0123456789", *f))
 	  f++;
 
 	/* The next part of a format specifier is a precision.  */
@@ -178,7 +178,7 @@ parse_format_string (const char **arg)
 	  {
 	    seen_prec = 1;
 	    f++;
-	    while (strchr ("0123456789", *f))
+	    while (*f != '\0' && strchr ("0123456789", *f))
 	      f++;
 	  }
 
diff --git a/gdb/testsuite/gdb.base/printcmds.exp b/gdb/testsuite/gdb.base/printcmds.exp
index 4883fd5..4f88382 100644
--- a/gdb/testsuite/gdb.base/printcmds.exp
+++ b/gdb/testsuite/gdb.base/printcmds.exp
@@ -728,6 +728,12 @@ proc test_printf {} {
     # Regression test for "%% at end of format string.
     # See http://sourceware.org/bugzilla/show_bug.cgi?id=11345
     gdb_test "printf \"%%%d%%\\n\", 5" "%5%"
+
+    # Some tests for missing format specifier after '%'.
+    gdb_test "printf \"%\", 0" "Incomplete format specifier at end of format string"
+    gdb_test "printf \"%.234\", 0" "Incomplete format specifier at end of format string"
+    gdb_test "printf \"%-\", 0" "Incomplete format specifier at end of format string"
+    gdb_test "printf \"%-23\", 0" "Incomplete format specifier at end of format string"
 }
 
 #Test printing DFP values with printf