[binutils-gdb] gdb: fix overflow caused by value_print_array_elements

[Stephan Rohr]

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=e776e429a4fa6717a82f1653d13f34960b8eab91

commit e776e429a4fa6717a82f1653d13f34960b8eab91
Author: Rohr, Stephan <stephan.rohr@intel.com>
Date:   Tue Oct 13 12:42:57 2026 +0000

    gdb: fix overflow caused by value_print_array_elements
    
    When printing an array whose stride is larger than its element type,
    GDB allocates memory for each array element based on the element's
    true type.  The allocated buffer may include some padding.
    "value_print_array_elements ()" passes the stride as the bit length to
    "from_component_bitsize ()".  This is silently swallowed if the stride
    does not exceed the size of the allocated buffer but corrupts the heap
    if the write goes beyond.  Pass the size of the element's true type
    instead.
    
    Approved-By: Tom Tromey <tom@tromey.com>

Diff:
---
 gdb/testsuite/gdb.dwarf2/arr-stride-gap.exp | 106 ++++++++++++++++++++++++++++
 gdb/valprint.c                              |  12 +++-
 2 files changed, 115 insertions(+), 3 deletions(-)

diff --git a/gdb/testsuite/gdb.dwarf2/arr-stride-gap.exp b/gdb/testsuite/gdb.dwarf2/arr-stride-gap.exp
new file mode 100644
index 00000000000..008d18c59d4
--- /dev/null
+++ b/gdb/testsuite/gdb.dwarf2/arr-stride-gap.exp
@@ -0,0 +1,106 @@
+# Copyright 2026 Free Software Foundation, Inc.
+
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# Test printing arrays whose stride is larger and smaller than their element
+# type.
+
+load_lib dwarf.exp
+
+require dwarf2_support
+
+standard_testfile main.c -dw.S
+set asm_file [standard_output_file $srcfile2]
+
+# Array of two shorts with a 128-byte stride.  The stride is chosen large
+# enough to safely exceed the buffer allocated for a 2-byte short.
+set stride 128
+set padding [lrepeat [expr {$stride - 1}] 0x00]
+set contents [list 0x01 {*}$padding 0x02 {*}$padding]
+
+# Array of two shorts with a 1-byte stride.  Each element is read w.r.t. the
+# stride, not the element type.
+set packed_stride 1
+set packed_contents {0x01 0x02}
+
+Dwarf::assemble $asm_file {
+    cu {} {
+	DW_TAG_compile_unit {
+	    DW_AT_language @DW_LANG_C99
+	} {
+	    declare_labels short_label strided_label packed_label
+
+	    short_label: DW_TAG_base_type {
+		DW_AT_byte_size 2 DW_FORM_sdata
+		DW_AT_encoding @DW_ATE_signed
+		DW_AT_name short
+	    }
+
+	    strided_label: DW_TAG_array_type {
+		DW_AT_type :$short_label
+		DW_AT_byte_stride $::stride DW_FORM_udata
+	    } {
+		DW_TAG_subrange_type {
+		    DW_AT_upper_bound 1 DW_FORM_data1
+		}
+	    }
+
+	    DW_TAG_variable {
+		DW_AT_name strided
+		DW_AT_type :$strided_label
+		DW_AT_location {
+		    DW_OP_implicit_value {*}$::contents
+		} SPECIAL_expr
+	    }
+
+	    packed_label: DW_TAG_array_type {
+		DW_AT_type :$short_label
+		DW_AT_byte_stride $::packed_stride DW_FORM_udata
+	    } {
+		DW_TAG_subrange_type {
+		    DW_AT_upper_bound 1 DW_FORM_data1
+		}
+	    }
+
+	    DW_TAG_variable {
+		DW_AT_name packed
+		DW_AT_type :$packed_label
+		DW_AT_location {
+		    DW_OP_implicit_value {*}$::packed_contents
+		} SPECIAL_expr
+	    }
+	}
+    }
+}
+
+if {[prepare_for_testing "failed to prepare" $testfile \
+	 [list $srcfile $asm_file] {nodebug}]} {
+    return
+}
+
+# Check that "print VAR" shows EXPECTED.  A crash of GDB is converted into
+# "unresolved".  Report it as a failure instead.
+proc test_print { var expected } {
+    gdb_test_multiple "print $var" "" {
+	-re -wrap " = $expected" {
+	    pass $gdb_test_name
+	}
+	-re "A fatal error internal to GDB has been detected" {
+	    fail "$gdb_test_name (GDB crashed)"
+	}
+    }
+}
+
+test_print strided "\\{1, 2\\}"
+test_print packed "\\{1, 2\\}"
diff --git a/gdb/valprint.c b/gdb/valprint.c
index 797f0f180c8..700973cde14 100644
--- a/gdb/valprint.c
+++ b/gdb/valprint.c
@@ -1981,9 +1981,15 @@ value_print_array_elements (struct value *val, struct ui_file *stream,
   struct type *type = check_typedef (val->type ());
 
   elttype = type->target_type ();
-  unsigned bit_stride = type->bit_stride ();
+  ULONGEST bit_stride = type->bit_stride ();
   if (bit_stride == 0)
     bit_stride = 8 * check_typedef (elttype)->length ();
+
+  /* For packed arrays, the stride may be smaller than the element's target
+     type.  */
+  ULONGEST elt_bits = std::min (bit_stride,
+				8 * check_typedef (elttype)->length ());
+
   index_type = type->index_type ();
   if (index_type->code () == TYPE_CODE_RANGE)
     index_type = index_type->target_type ();
@@ -2034,7 +2040,7 @@ value_print_array_elements (struct value *val, struct ui_file *stream,
 
       struct value *element = val->from_component_bitsize (elttype,
 							   bit_stride * i,
-							   bit_stride);
+							   elt_bits);
       rep1 = i + 1;
       reps = 1;
       /* Only check for reps if repeat_count_threshold is not set to
@@ -2055,7 +2061,7 @@ value_print_array_elements (struct value *val, struct ui_file *stream,
 	      struct value *rep_elt
 		= val->from_component_bitsize (elttype,
 					       rep1 * bit_stride,
-					       bit_stride);
+					       elt_bits);
 	      bool repeated = ((available
 				&& rep_elt->entirely_available ()
 				&& element->contents_eq (rep_elt))