[RFA2] Follow-up decode_line_1 crash

Keith Seitz keiths@cygnus.com
Wed Mar 14 08:28:00 GMT 2001


Problem:

$ gdb -nw -nx -q
(gdb) b "foo"
Segmentation fault (core dumped)

decode_linespec_1 does something like:

char *p = *argptr; (the first quote in "foo")
if (p == '"')
  {
    p++;
    is_quote_enclosed = 1;
  }

  if (is_quote_enclosed)
    {
      char *closing_quote = strchr (p, '"');
      if (closing_quote && closing_quote[1] == '\0')
	*closing_quote = '\0';
    }

/* so now p looks like foo with no quotes and *argptr is "foo */


char *copy = (char *) alloca (p - *argptr + 1); <-- alloca of 0 bytes
memcpy (copy, *argptr, p - *argptr); <-- copy -1 bytes
 
Patch:

Index: linespec.c
===================================================================
RCS file: /cvs/cvsfiles/devo/gdb/linespec.c,v
retrieving revision 2.4
diff -p -p -r2.4 linespec.c
*** linespec.c	2000/12/20 14:34:15	2.4
--- linespec.c	2001/03/14 16:16:11
*************** decode_line_1 (char **argptr, int funfir
*** 611,620 ****
  
    s = NULL;
    p = *argptr;
!   if (p[0] == '"')
      {
        is_quote_enclosed = 1;
!       p++;
      }
    else
      is_quote_enclosed = 0;
--- 611,620 ----
  
    s = NULL;
    p = *argptr;
!   if (**argptr == '"')
      {
        is_quote_enclosed = 1;
!       (*argptr)++;
      }
    else
      is_quote_enclosed = 0;

Tested on RH6.2. Should be generic enough to apply to all targets. I'm no 
expert at this stuff, but a crash is Just Plain Bad (TM).

Keith



More information about the Gdb-patches mailing list