[Bug gdb/34368] New: [gdb] accepts DW_OP_reinterpret between base types of equal byte size but different bit size

https://sourceware.org/bugzilla/show_bug.cgi?id=34368

            Bug ID: 34368
           Summary: [gdb] accepts DW_OP_reinterpret between base types of
                    equal byte size but different bit size
           Product: gdb
           Version: HEAD
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: gdb
          Assignee: unassigned at sourceware dot org
          Reporter: firmiana402 at gmail dot com
  Target Milestone: ---

This is closely related to bug #34365 and is filed separately
because it is a distinct fix point. Both stem from GDB comparing
base types by byte size while ignoring DW_AT_bit_size, but #34365
is about base_types_equal_p (the same-type check shared by the
typed binary and relational operators), whereas this is the size
guard of DW_OP_reinterpret — a different check with its own fix.

DWARF v5 (§2.5.1.6, Type Conversions) requires the operand type
and the result type of DW_OP_reinterpret to have the same size in
bits; the operation is a bit-preserving reinterpretation. GDB
validates only the byte length, so it accepts a reinterpretation
between two base types that occupy the same number of bytes but
carry a different DW_AT_bit_size, for example GCC's _BitInt(31)
and _BitInt(32), both 4-byte signed and differing only in bit
size (31 vs 32) — which the standard requires to be rejected.

The check is in the DW_OP_reinterpret case of
execute_stack_op (gdb/dwarf2/expr.c):

    if (op == DW_OP_convert || op == DW_OP_GNU_convert)
      result_val = value_cast (type, result_val);
    else if (type == result_val->type ())
      {
        /* Nothing.  */
      }
    else if (type->length () != result_val->type ()->length ())
      error (_("DW_OP_reinterpret has wrong size"));
    else
      result_val
        = value_from_contents (type, result_val->contents_all ().data ());

The size guard compares type->length (), i.e. bytes. GDB already
records the logical bit size of a base type (type->bit_size (),
and type->bit_size_differs_p () for exactly the case where it
differs from the byte size), but this check does not consult it,
so 4-byte types with 31 and 32 logical bits pass as if equal and
value_from_contents copies the bytes.

-- 
You are receiving this mail because:
You are on the CC list for the bug.