[Bug gdb/34290] New: [gdb] gdb is missing DW_OP_deref_size size checks in two evaluator paths

https://sourceware.org/bugzilla/show_bug.cgi?id=34290

            Bug ID: 34290
           Summary: [gdb] gdb is missing DW_OP_deref_size size checks in
                    two evaluator paths
           Product: gdb
           Version: unknown
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: gdb
          Assignee: unassigned at sourceware dot org
          Reporter: firmiana402 at gmail dot com
  Target Milestone: ---

While looking at the DWARF expression evaluator (gdb/dwarf2/expr.c), I noticed
that gdb does not check the size operand of DW_OP_deref_size in two different
places.

In DWARF v5, DW_OP_deref_size takes a single 1-byte unsigned operand. That
operand gives the number of bytes to read, and the standard also says that this
size may not be larger than the size of an address on the target machine.

So, on a target with 8-byte addresses, any DW_OP_deref_size operand larger than
8 is malformed and should be rejected at the opcode itself.

I found two places where gdb currently does not seem to enforce that rule.

The first is the ordinary evaluator path (gdb/dwarf2/expr.c,
dwarf_expr_context::execute_stack_op) for DW_OP_deref_size, where an oversized
operand is accepted.

The second is (gdb/dwarf2/expr.c, dwarf_block_to_dwarf_reg_deref), a helper
function that parses the restricted nested subexpressions in DW_OP_entry_value.
That helper explicitly accepts nested forms such as:

```text
DW_OP_breg*(0)
DW_OP_deref_size <k>
```

but it also does not appear to check that <k> is at most the target address
width before continuing.

This looks like the same general class of bug as bug #34277 for
DW_OP_deref_type: in both cases, the dereference opcode is missing a required
size validation. The difference is that DW_OP_deref_type has to check the
relationship between the explicit size operand and the referenced base type,
while `DW_OP_deref_size` is simpler and only needs to enforce the DWARF rule
that the size must not exceed the target address width.

-- 
You are receiving this mail because:
You are on the CC list for the bug.