diff mbox series

[v2] gdbserver: Fix overflow detection in gdbserver

Message ID 20240219141955.34929-1-kirill.radkin@syntacore.com
State New
Headers
Series [v2] gdbserver: Fix overflow detection in gdbserver |

Checks

Context Check Description
linaro-tcwg-bot/tcwg_gdb_build--master-aarch64 success Testing passed
linaro-tcwg-bot/tcwg_gdb_build--master-arm success Testing passed
linaro-tcwg-bot/tcwg_gdb_check--master-arm success Testing passed
linaro-tcwg-bot/tcwg_gdb_check--master-aarch64 success Testing passed

Commit Message

Kirill Radkin Feb. 19, 2024, 2:19 p.m. UTC 
  > I don't understand this early return.
> If using an unsigned type here is intended to be invalid, then I think
> that should be enforced at compile time.

Early return removed.

> However, it seems pretty simple to handle unsigned here as well.

Added.

Currently gdbserver uses require_int() function to
parse the requested offset (in vFile::pread
packet and the like). This function allows integers up to 0x7fffffff
(to fit in 32-bit int), however the offset (for pread
system call) has an off_t type which can be larger than
32-bit.

This patch allows require_int() function to parse offset
up to the maximum value implied by the off_t type.
---
 gdb/testsuite/gdb.server/pread-offset-size.S  | 23 +++++++++
 .../gdb.server/pread-offset-size.exp          | 50 +++++++++++++++++++
 gdbserver/hostio.cc                           | 17 +++++--
 3 files changed, 86 insertions(+), 4 deletions(-)
 create mode 100644 gdb/testsuite/gdb.server/pread-offset-size.S
 create mode 100644 gdb/testsuite/gdb.server/pread-offset-size.exp
diff mbox series

Patch

diff --git a/gdb/testsuite/gdb.server/pread-offset-size.S b/gdb/testsuite/gdb.server/pread-offset-size.S
new file mode 100644
index 00000000000..b07058e5550
--- /dev/null
+++ b/gdb/testsuite/gdb.server/pread-offset-size.S
@@ -0,0 +1,23 @@ 
+/* This testcase is part of GDB, the GNU debugger.
+
+   Copyright 2023 Free Software Foundation, Inc.
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.  */
+
+	.text
+	.globl	_start
+_start:
+	.skip 3742415472
+	.globl	f
+f:
diff --git a/gdb/testsuite/gdb.server/pread-offset-size.exp b/gdb/testsuite/gdb.server/pread-offset-size.exp
new file mode 100644
index 00000000000..221491bfa04
--- /dev/null
+++ b/gdb/testsuite/gdb.server/pread-offset-size.exp
@@ -0,0 +1,50 @@ 
+# Copyright (C) 2023 Free Software Foundation, Inc.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+# Test sending of large binary files (>2 GB) from gdbserver
+# (it was unavailable earlier)
+
+load_lib gdbserver-support.exp
+
+if {![allow_gdbserver_tests]} {
+    return
+}
+
+standard_testfile .S
+
+if { [prepare_for_testing ${testfile}.exp $testfile \
+      $srcfile {debug additional_flags=-nostdlib} ] } {
+    return -1
+}
+
+gdb_exit
+gdb_start
+
+gdb_test_no_output "set remote exec-file $binfile" \
+"set remote exec-file"
+
+# Make sure we're disconnected, in case we're testing with an
+# extended-remote board, therefore already connected.
+gdb_test "disconnect" ".*"
+
+set res [gdbserver_spawn ""]
+set gdbserver_protocol [lindex $res 0]
+set gdbserver_gdbport [lindex $res 1]
+
+gdb_test "target $gdbserver_protocol $gdbserver_gdbport" \
+"Remote debugging using .*" \
+"target $gdbserver_protocol $gdbserver_gdbport"
+
+gdb_test "break f" "Breakpoint 1.*"
diff --git a/gdbserver/hostio.cc b/gdbserver/hostio.cc
index ea70c26da0f..fcee553c5a3 100644
--- a/gdbserver/hostio.cc
+++ b/gdbserver/hostio.cc
@@ -90,12 +90,18 @@  require_filename (char **pp, char *filename)
   return 0;
 }
 
+template <typename T>
 static int
-require_int (char **pp, int *value)
+require_int (char **pp, T *value)
 {
+  constexpr bool is_signed = std::is_signed<T>::value;
+
   char *p;
   int count, firstdigit;
 
+  /* Max count of hexadecimal digits in off_t (1 hex digit is 4 bits) */
+  int max_count = sizeof(T) * CHAR_BIT / 4;
+
   p = *pp;
   *value = 0;
   count = 0;
@@ -112,7 +118,8 @@  require_int (char **pp, int *value)
 	firstdigit = nib;
 
       /* Don't allow overflow.  */
-      if (count >= 8 || (count == 7 && firstdigit >= 0x8))
+      if (count >= max_count || (is_signed && count == (max_count - 1)
+				 && firstdigit >= 0x8))
 	return -1;
 
       *value = *value * 16 + nib;
@@ -344,7 +351,8 @@  handle_open (char *own_buf)
 static void
 handle_pread (char *own_buf, int *new_packet_len)
 {
-  int fd, ret, len, offset, bytes_sent;
+  int fd, ret, len, bytes_sent;
+  off_t offset;
   char *p, *data;
   static int max_reply_size = -1;
 
@@ -411,7 +419,8 @@  handle_pread (char *own_buf, int *new_packet_len)
 static void
 handle_pwrite (char *own_buf, int packet_len)
 {
-  int fd, ret, len, offset;
+  int fd, ret, len;
+  off_t offset;
   char *p, *data;
 
   p = own_buf + strlen ("vFile:pwrite:");