[Bug gdb/34277] New: [gdb] gdb misses the width check required by DW_OP_deref_type/DW_OP_GNU_deref_type

https://sourceware.org/bugzilla/show_bug.cgi?id=34277

            Bug ID: 34277
           Summary: [gdb] gdb misses the width check required by
                    DW_OP_deref_type/DW_OP_GNU_deref_type
           Product: gdb
           Version: HEAD
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: gdb
          Assignee: unassigned at sourceware dot org
          Reporter: wujielun402 at gmail dot com
  Target Milestone: ---

`DW_OP_deref_type` / `DW_OP_GNU_deref_type` in DWARF v5 carries both:

- an explicit dereference size
- a referenced base type

and the standard requires these to agree.

[DWARF v5](https://dwarfstd.org/doc/DWARF5.pdf) Section 2.5.1.3 says that for
`DW_OP_deref_type`, the first operand is a 1-byte unsigned size, and that this
size is the same as the size of the base type referenced by the second
operand.

So an operation such as:

```text
DW_OP_deref_type 4, <long unsigned int>
```

is invalid if `long unsigned int` is an 8-byte base type.

That kind of mismatch should be rejected at the `DW_OP_deref_type` operation
itself.

While reviewing `gdb`'s evaluator in `gdb/dwarf2/expr.c`, I noticed that the
current implementation reads the explicit dereference size and the referenced
base type, but does not check that their widths match.

A minimal patch in this branch would be:

```diff
@@
     if (op == DW_OP_deref_type || op == DW_OP_GNU_deref_type)
       {
         op_ptr = safe_read_uleb128 (op_ptr, op_end, &uoffset);
         cu_offset type_die_cu_off = (cu_offset) uoffset;
         type = get_base_type (type_die_cu_off);
+        if (type->length () != addr_size)
+          error (_("DW_OP_deref_type has different sizes for type and data"));
       }
```

These two added lines are the missing width check.

They are also consistent with the nearby `DW_OP_const_type` branch, which
already does the analogous size-consistency validation:

```c
if (type->length () != n)
  error (_("DW_OP_const_type has different sizes for type and data"));
```

-- 
You are receiving this mail because:
You are on the CC list for the bug.