mirror/binutils-gdb
2
0
Fork 0
mirror of https://sourceware.org/git/binutils-gdb.git synced 2024-11-27 03:51:15 +08:00
Code Issues Packages Projects Releases Wiki Activity

parse_number("0") reads uninitialized memory

Browse Source 
valgrind caught that parse_number reads uninitialized memory when we
parse literal "0":

 $ valgrind ./gdb -q -nx -ex "set height 0"
 (...)
 ==10378== Conditional jump or move depends on uninitialised value(s)
 ==10378==    at 0x548A10: parse_number (c-exp.y:1828)
 ==10378==    by 0x54A340: lex_one_token (c-exp.y:2638)
 ==10378==    by 0x54B4BB: c_lex (c-exp.y:3089)
 ==10378==    by 0x544951: c_parse_internal (c-exp.c:2208)
 ==10378==    by 0x54BF8C: c_parse (c-exp.y:3260)
 ==10378==    by 0x6502E7: parse_exp_in_context_1 (parse.c:1221)
 ==10378==    by 0x650064: parse_exp_in_context (parse.c:1122)
 ==10378==    by 0x65001F: parse_exp_1 (parse.c:1114)
 ==10378==    by 0x650421: parse_expression (parse.c:1266)
 ==10378==    by 0x5A74B7: parse_and_eval_long (eval.c:92)
 ==10378==    by 0x501ABD: do_set_command (cli-setshow.c:302)
 ==10378==    by 0x721059: execute_command (top.c:452)
 ==10378==
 (gdb)

I've pushed the obvious fix.

Tested on x86_64 Fedora 20.

gdb/ChangeLog:
	* c-exp.y (parse_number): Skip handling base-switching prefixes if
	the input is only one character long.
This commit is contained in:
Pedro Alves 2014-09-04 21:46:28 +01:00
parent eb0b04635f
commit ebf13736b4
2 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
gdb/ChangeLog
View File

@ -1,3 +1,8 @@
2014-09-04 Pedro Alves <palves@redhat.com>
* c-exp.y (parse_number): Skip handling base-switching prefixes if
the input is only one character long.
2014-09-04 Sergio Durigan Junior <sergiodj@redhat.com>
PR fortran/17237

2
gdb/c-exp.y
View File

@ -1824,7 +1824,7 @@ parse_number (struct parser_state *par_state,
}
/* Handle base-switching prefixes 0x, 0t, 0d, 0 */
if (p[0] == '0')
if (p[0] == '0' && len > 1)
switch (p[1])
{
case 'x':