[PATCH] GDB: Fix the overflow in addr_is_displayed()

Shahab Vahedi <[email protected]>
Newsgroups gmane.comp.gdb.devel,gmane.comp.gdb.patches
Message-ID <[email protected]>
From: Shahab Vahedi <[email protected]>

In a corner case scenario, where the height of the assembly TUI is
bigger than the number of instructions in the whole program, GDB
dumps core. The problem roots in this condition check:

  int i = 0;
  while (i < content. size() - threshold ...) {
    ... content[i] ...
  }

"threshold" is 2 and there are times that "content. size()" is 0.
This results into an overflow and the loop is entered whereas it
should have been skipped.

This has been discussed at length in bug 25345:
  https://sourceware.org/bugzilla/show_bug.cgi?id=25345

gdb/ChangeLog:
2020-01-04  Shahab Vahedi  <[email protected]>
        * tui/tui-disasm.c (tui_disasm_window::addr_is_displayed):
        Treat "content.size()" as "int" to avoid overflow.
---
 gdb/tui/tui-disasm.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/gdb/tui/tui-disasm.c b/gdb/tui/tui-disasm.c
index c72b50730b0..a0921eb09d1 100644
--- a/gdb/tui/tui-disasm.c
+++ b/gdb/tui/tui-disasm.c
@@ -349,10 +349,10 @@ bool
 tui_disasm_window::addr_is_displayed (CORE_ADDR addr) const
 {
   bool is_displayed = false;
-  int threshold = SCROLL_THRESHOLD;
+  int nr_of_lines = int(content.size()) - int(SCROLL_THRESHOLD);
 
   int i = 0;
-  while (i < content.size () - threshold && !is_displayed)
+  while (i < nr_of_lines && !is_displayed)
     {
       is_displayed
 	= (content[i].line_or_addr.loa == LOA_ADDRESS
-- 
2.24.1
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.