Fix buffer overrun found by Coverity

  Hi all,

This commit fixes a buffer overrun found by Coverity, where 36 bytes
are written into the 24 byte buffer "ids".  The "ids_seen" buffer
doesn't overrun, but I've changed that too, to future-proof it some.

I would have committed this as obvious, but the testsuite doesn't
exercise this piece of code; I can't realistically say I've regression
tested this change, so I'd like another pair of eyes on it to be sure.

Cheers,
Gary

--
gdb/ChangeLog:

	* dwarf2read.c (create_dwp_hash_table): Fix buffer overrun
	found by Coverity.
---
 gdb/ChangeLog    | 5 +++++
 gdb/dwarf2read.c | 5 +++--
 2 files changed, 8 insertions(+), 2 deletions(-)
  

>>>>> "Gary" == Gary Benson <gbenson@redhat.com> writes:

Gary> I would have committed this as obvious, but the testsuite doesn't
Gary> exercise this piece of code; I can't realistically say I've regression
Gary> tested this change, so I'd like another pair of eyes on it to be sure.

What about the fission-dwp.exp board maybe?
Or one of the other boards.

Gary> -      memset (ids, 255, (DW_SECT_MAX + 1) * sizeof (int32_t));
Gary> -      memset (ids_seen, 255, (DW_SECT_MAX + 1) * sizeof (int32_t));
Gary> +      memset (ids, 255, sizeof_ids);
Gary> +      memset (ids_seen, 255, sizeof (ids_seen));

Later the code does this:

	  if (id < DW_SECT_MIN || id > DW_SECT_MAX)
	    {
	      error (_("Dwarf Error: bad DWP hash table, bad section id %d"
[...]
	  ids_seen[id] = i;
	  ids[i] = id;

So I think it would be good to ensure that MAX_NR_V2_DWO_SECTIONS is
>= DW_SECT_MAX + 1.  At least if I'm understanding this properly.

Tom
  

Tom Tromey wrote:
> >>>>> "Gary" == Gary Benson <gbenson@redhat.com> writes:
> 
> Gary> I would have committed this as obvious, but the testsuite
> Gary> doesn't exercise this piece of code; I can't realistically
> Gary> say I've regression tested this change, so I'd like another
> Gary> pair of eyes on it to be sure.
> 
> What about the fission-dwp.exp board maybe?
> Or one of the other boards.

Oh, good call, it does.

> Gary> -      memset (ids, 255, (DW_SECT_MAX + 1) * sizeof (int32_t));
> Gary> -      memset (ids_seen, 255, (DW_SECT_MAX + 1) * sizeof (int32_t));
> Gary> +      memset (ids, 255, sizeof_ids);
> Gary> +      memset (ids_seen, 255, sizeof (ids_seen));
> 
> Later the code does this:
> 
> 	  if (id < DW_SECT_MIN || id > DW_SECT_MAX)
> 	    {
> 	      error (_("Dwarf Error: bad DWP hash table, bad section id %d"
> [...]
> 	  ids_seen[id] = i;
> 	  ids[i] = id;
> 
> So I think it would be good to ensure that MAX_NR_V2_DWO_SECTIONS is
> >= DW_SECT_MAX + 1.  At least if I'm understanding this properly.

I don't *think* it's necessary:

 ids_seen is indexed by "id",
 which is 1 <= id <= DW_SECT_MAX;

 ids is indexed by "i",
 which is 0 <= i < nr_columns,
 and nr_columns is nr_columns <= MAX_NR_V2_DWO_SECTIONS,
 so 0 <= i < MAX_NR_V2_DWO_SECTIONS.

i.e. the dimensions are right, it's just the memset which isn't.
I think!

Ok, so this one's built and regtested on RHEL 7.5 x86_64 now, with
the fission-dwp.exp board.  Assuming the dimensions thing above is
correct, is this ok to commit?

Cheers,
Gary
  

>>>>> "Gary" == Gary Benson <gbenson@redhat.com> writes:

Gary> I don't *think* it's necessary:
[...]

I agree, thanks for breaking it down for me.

Gary> Ok, so this one's built and regtested on RHEL 7.5 x86_64 now, with
Gary> the fission-dwp.exp board.  Assuming the dimensions thing above is
Gary> correct, is this ok to commit?

Yes, thank you.

Tom
  

Tom Tromey wrote:
> >>>>> "Gary" == Gary Benson <gbenson@redhat.com> writes:
> 
> Gary> I don't *think* it's necessary:
> [...]
> 
> I agree, thanks for breaking it down for me.
> 
> Gary> Ok, so this one's built and regtested on RHEL 7.5 x86_64 now,
> Gary> with the fission-dwp.exp board.  Assuming the dimensions thing
> Gary> above is correct, is this ok to commit?
> 
> Yes, thank you.

Cool, I've pushed it.  Thanks for the review :D

Cheers,
Gary