diff mbox

Remove MAX_REGISTER_SIZE from py-unwind.c

Message ID 82556349-1E8C-44C3-9FC9-68F15E36D4D4@arm.com
State New, archived
Headers

Commit Message

Alan Hayward June 22, 2017, 1:13 p.m. UTC 
  > On 22 Jun 2017, at 10:08, Yao Qi <qiyaoltc@gmail.com> wrote:
> 
> Alan Hayward <Alan.Hayward@arm.com> writes:
> 
>>     cached_frame
>> -      = ((cached_frame_info *)
>> -	 xmalloc (sizeof (*cached_frame)
>> -		  + reg_count * sizeof (cached_frame->reg[0])));
>> +      = ((cached_frame_info *) xmalloc (sizeof (*cached_frame)));
> 
> Use XNEW, the code can be shorter,
> 
>> @@ -601,6 +591,13 @@ static void
>> pyuw_dealloc_cache (struct frame_info *this_frame, void *cache)
>> {
>>   TRACE_PY_UNWIND (3, "%s: enter", __FUNCTION__);
>> +  cached_frame_info *cached_frame = (cached_frame_info *) cache;
>> +
>> +  for (int i = 0; cached_frame->reg_count; i++)
>> +    {
>> +      xfree (cached_frame->reg[i].data);
>> +    }
> 
> No need to use braces.
> 
> Otherwise, patch is good to me.
> 
> -- 
> Yao (齐尧)


Ok, pushed with changes as suggested.

Patch below.

Thanks,
Alan.

Comments

Pedro Alves June 22, 2017, 1:22 p.m. UTC | #1 
On 06/22/2017 02:13 PM, Alan Hayward wrote:

> Ok, pushed with changes as suggested.
> 
> Patch below.

Sorry, but this looks broken to me.

cached_frame_info is using the trailing array idiom ...

> @@ -93,7 +84,7 @@ typedef struct
>    /* Length of the `reg' array below.  */
>    int reg_count;
> 
> -  struct reg_info reg[];
> +  cached_reg_t reg[];
>  } cached_frame_info;
> 

> 
> -    cached_frame
> -      = ((cached_frame_info *)
> -	 xmalloc (sizeof (*cached_frame)
> -		  + reg_count * sizeof (cached_frame->reg[0])));
> +    cached_frame = XNEW (cached_frame_info);

but now you're not allocating enough space for the array elements...


>      cached_frame->gdbarch = gdbarch;
>      cached_frame->frame_id = unwind_info->frame_id;
>      cached_frame->reg_count = reg_count;
> @@ -580,13 +568,14 @@ pyuw_sniffer (const struct frame_unwind *self, struct frame_info *this_frame,
>          struct value *value = value_object_to_value (reg->value);
>          size_t data_size = register_size (gdbarch, reg->number);
> 
> -        cached_frame->reg[i].number = reg->number;
> +	cached_frame->reg[i].num = reg->number;

... that you're accessing here and below.

Valgrind probably shows the now-out-of-bounds accesses.

> 
>          /* `value' validation was done before, just assert.  */
>          gdb_assert (value != NULL);
>          gdb_assert (data_size == TYPE_LENGTH (value_type (value)));
>          gdb_assert (data_size <= MAX_REGISTER_SIZE);
> 
> +	cached_frame->reg[i].data = (gdb_byte *) xmalloc (data_size);
>          memcpy (cached_frame->reg[i].data, value_contents (value), data_size);
>        }
>    }
> @@ -601,6 +590,11 @@ static void
>  pyuw_dealloc_cache (struct frame_info *this_frame, void *cache)
>  {
>    TRACE_PY_UNWIND (3, "%s: enter", __FUNCTION__);
> +  cached_frame_info *cached_frame = (cached_frame_info *) cache;
> +
> +  for (int i = 0; cached_frame->reg_count; i++)
> +    xfree (cached_frame->reg[i].data);
> +
>    xfree (cache);
>  }
>
diff mbox

Patch

diff --git a/gdb/python/py-unwind.c b/gdb/python/py-unwind.c
index a5c2873697944c1293fdd9f8265dde078378e6c2..da1703ecf2b843d9a6790f095e64c2915280ae35 100644
--- a/gdb/python/py-unwind.c
+++ b/gdb/python/py-unwind.c
@@ -73,15 +73,6 @@  typedef struct
 /* The data we keep for a frame we can unwind: frame ID and an array of
    (register_number, register_value) pairs.  */

-struct reg_info
-{
-  /* Register number.  */
-  int number;
-
-  /* Register data bytes pointer.  */
-  gdb_byte data[MAX_REGISTER_SIZE];
-};
-
 typedef struct
 {
   /* Frame ID.  */
@@ -93,7 +84,7 @@  typedef struct
   /* Length of the `reg' array below.  */
   int reg_count;

-  struct reg_info reg[];
+  cached_reg_t reg[];
 } cached_frame_info;

 extern PyTypeObject pending_frame_object_type
@@ -483,14 +474,14 @@  pyuw_prev_register (struct frame_info *this_frame, void **cache_ptr,
                     int regnum)
 {
   cached_frame_info *cached_frame = (cached_frame_info *) *cache_ptr;
-  struct reg_info *reg_info = cached_frame->reg;
-  struct reg_info *reg_info_end = reg_info + cached_frame->reg_count;
+  cached_reg_t *reg_info = cached_frame->reg;
+  cached_reg_t *reg_info_end = reg_info + cached_frame->reg_count;

   TRACE_PY_UNWIND (1, "%s (frame=%p,...,reg=%d)\n", __FUNCTION__, this_frame,
                    regnum);
   for (; reg_info < reg_info_end; ++reg_info)
     {
-      if (regnum == reg_info->number)
+      if (regnum == reg_info->num)
         return frame_unwind_got_bytes (this_frame, regnum, reg_info->data);
     }

@@ -566,10 +557,7 @@  pyuw_sniffer (const struct frame_unwind *self, struct frame_info *this_frame,
     saved_reg *reg;
     int i;

-    cached_frame
-      = ((cached_frame_info *)
-	 xmalloc (sizeof (*cached_frame)
-		  + reg_count * sizeof (cached_frame->reg[0])));
+    cached_frame = XNEW (cached_frame_info);
     cached_frame->gdbarch = gdbarch;
     cached_frame->frame_id = unwind_info->frame_id;
     cached_frame->reg_count = reg_count;
@@ -580,13 +568,14 @@  pyuw_sniffer (const struct frame_unwind *self, struct frame_info *this_frame,
         struct value *value = value_object_to_value (reg->value);
         size_t data_size = register_size (gdbarch, reg->number);

-        cached_frame->reg[i].number = reg->number;
+	cached_frame->reg[i].num = reg->number;

         /* `value' validation was done before, just assert.  */
         gdb_assert (value != NULL);
         gdb_assert (data_size == TYPE_LENGTH (value_type (value)));
         gdb_assert (data_size <= MAX_REGISTER_SIZE);

+	cached_frame->reg[i].data = (gdb_byte *) xmalloc (data_size);
         memcpy (cached_frame->reg[i].data, value_contents (value), data_size);
       }
   }
@@ -601,6 +590,11 @@  static void
 pyuw_dealloc_cache (struct frame_info *this_frame, void *cache)
 {
   TRACE_PY_UNWIND (3, "%s: enter", __FUNCTION__);
+  cached_frame_info *cached_frame = (cached_frame_info *) cache;
+
+  for (int i = 0; cached_frame->reg_count; i++)
+    xfree (cached_frame->reg[i].data);
+
   xfree (cache);
 }

diff --git a/gdb/regcache.h b/gdb/regcache.h
index b2e8a749d486608a90a82583ed8c74ad681baccb..4af9fbdcdbcdb508a76d758e705b9fb5008291af 100644
--- a/gdb/regcache.h
+++ b/gdb/regcache.h
@@ -232,6 +232,14 @@  enum regcache_dump_what
   regcache_dump_remote
 };

+/* A (register_number, register_value) pair.  */
+
+typedef struct cached_reg
+{
+  int num;
+  gdb_byte *data;
+} cached_reg_t;
+
 /* The register cache for storing raw register values.  */

 class regcache
diff --git a/gdb/remote.c b/gdb/remote.c
index b66ecee7f6db8e2a691b9e12f6ce314da22d69eb..8e8ee6f8705069a3f69fd8c883b7ea37db5de851 100644
--- a/gdb/remote.c
+++ b/gdb/remote.c
@@ -6311,12 +6311,6 @@  remote_console_output (char *msg)
   gdb_flush (gdb_stdtarg);
 }

-typedef struct cached_reg
-{
-  int num;
-  gdb_byte *data;
-} cached_reg_t;
-
 DEF_VEC_O(cached_reg_t);

 typedef struct stop_reply