[Bug gdb/34288] New: gdb accepts invalid DW_OP_bra / DW_OP_skip branch targets

https://sourceware.org/bugzilla/show_bug.cgi?id=34288

            Bug ID: 34288
           Summary: gdb accepts invalid DW_OP_bra / DW_OP_skip branch
                    targets
           Product: gdb
           Version: HEAD
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: gdb
          Assignee: unassigned at sourceware dot org
          Reporter: firmiana402 at gmail dot com
  Target Milestone: ---

I found that GDB accepts some malformed DWARF expression branch targets even
when the 2-byte branch operand itself is present and can be decoded
successfully.

This does not appear to be a truncated-operand issue. Rather, the branch offset
is decoded first, and the resulting target address is not fully validated
afterwards.

Two malformed target classes are:

- the decoded target lands outside the current expression
- the decoded target lands in the middle of another opcode's operand bytes

Both cases seem to represent malformed control flow in the DWARF expression and
should probably be rejected.

For comparison, I checked LLDB's implementation. At least for the first class
of malformed targets, LLDB rejects the expression via a bounded check, which
seems more robust than GDB's current behavior.

This may also be related to bug #34239. I would be interested in others'
opinions on whether these cases should be treated as invalid DWARF expressions
and rejected by GDB.

-- 
You are receiving this mail because:
You are on the CC list for the bug.