[Bug rust/33123] New: Out-of-bound memory write in compute_variant_fields_inner

[quentin.sabah at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=33123

            Bug ID: 33123
           Summary: Out-of-bound memory write in
                    compute_variant_fields_inner
           Product: gdb
           Version: 16.3
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: rust
          Assignee: unassigned at sourceware dot org
          Reporter: quentin.sabah at gmail dot com
  Target Milestone: ---

Summary:
GDB 16.3 and HEAD crash with "stack smashing detected" when stepping into a
Rust struct method with self having an Option<u128> field.


Steps to Reproduce:
reduced Rust program:
```
    // crash.rs
    struct CrashGdb {
        f: Option<u128>,
    }

    impl CrashGdb {
        fn crash(&self) {
            println!("no crash ? {:?}", self.f);
        }
    }

    fn main() {
        CrashGdb { f: None }.crash(); // Step here
    }
```

Compile and debug:
GDB must be built with stack protector (as in Fedora 41). Or add the gdb_assert
as described below in the Diagnosis paragraph.

```
    rustc -g crash.rs
    gdb --args ./crash
```

In GDB:
```
    (gdb) start
    (gdb) step
```

Result:
```
    *** stack smashing detected ***: terminated
```


Diagnosis:
The crash occurs in compute_variant_fields_inner in gdb/gdbtypes.c line 2611
due to a buffer overflow at `read_memory`:
```
    size = type->field (idx).type ()->length ();
    gdb_byte bits[sizeof (ULONGEST)];
    read_memory (addr, bits, size);
```

When stepping into the method, size == 16 but bits[] has only 8 elements. This
causes an out-of-bounds write in:
```
    // I added this assertion
    gdb_assert(size <= sizeof(ULONGEST));  // fails: size == 16
    read_memory(addr, bits, size);
``

Stack protector (-fstack-protector) makes the issue immediately fatal, but the
overflow exists regardless.



Workaround / Suggested Fix:
Increase the size of the bits buffer:
```
    gdb_byte bits[2 * sizeof (ULONGEST)];
```


This is reproducible with:
- GDB 16.3 (Fedora 41)
  GNU gdb (Fedora Linux) 16.3-1.fc41
  This GDB was configured as "x86_64-redhat-linux-gnu"
- GDB HEAD (commit b054ff604253af016657d5c93e2f69dab14cc53a)
- Crash when GDB compiled with -fstack-protector
- rustc 1.81.0 and 1.85.0
- Kernel:
  Linux workstation 6.15.3-100.fc41.x86_64 #1 SMP PREEMPT_DYNAMIC Thu Jun 19
15:09:31 UTC 2025 x86_64 GNU/Linux

-- 
You are receiving this mail because:
You are on the CC list for the bug.