diff mbox

Fix printf of a convenience variable holding an inferior address

Message ID 20200302024616.1049417-1-sergiodj@redhat.com
State New, archived
Headers

Commit Message

Sergio Durigan Junior March 2, 2020, 2:46 a.m. UTC 
  Back at:

commit 1f6f6e21fa86dc3411a6498608f32e9eb24b7851
Author: Philippe Waroquiers <philippe.waroquiers@skynet.be>
Date:   Mon Jun 10 21:41:51 2019 +0200

    Ensure GDB printf command can print convenience var strings without a target.

GDB was extended in order to allow the printing of convenience
variables that are strings without a target.  However, this introduced
a regression that hasn't been caught by our testsuite (because there
were no tests for it).

The problem happens when we try to print a convenience variable that
holds the address of a string in the inferior.  The following
two-liners can reproduce the issue:

$ echo -e 'int main(){const char a[]="test";return 0;}' | gcc -x c - -O0-g3
$ ./gdb/gdb --data-directory ./gdb/data-directory -q ./a.out -ex 'start' -ex 'set $x = (const char *) (&a[0] + 2)' -ex 'printf "%s\n", $x'

After some investigation, I found that the problem happens on
printcmd.c:printf_c_string.  In the case above, we're taking the first
branch of the 'if' condition, which assumes that there will be a value
to be printed at "value_contents (value)".  There isn't.  We actually
need to obtain the address that the variable points to, and read the
contents from memory.

It seems to me that we should avoid this branch if the TYPE_CODE of
"value_type (value)" is TYPE_CODE_PTR (i.e., a pointer to the
inferior's memory).  This is what this patch does.

I took the liberty to extend the current testcase under
gdb.base/printcmds.exp and create a test that exercises this scenario.

No regressions have been found on Buildbot.

gdb/ChangeLog:
2020-03-02  Sergio Durigan Junior  <sergiodj@redhat.com>

	* printcmd.c (print_c_string): Check also for TYPE_CODE_PTR
	when verifying if dealing with a convenience variable.

gdb/testsuite/ChangeLog:
2020-03-02  Sergio Durigan Junior  <sergiodj@redhat.com>

	* gdb.base/printcmds.exp: Add test to verify printf of a
	variable holding an address.
---
 gdb/printcmd.c                       | 3 ++-
 gdb/testsuite/gdb.base/printcmds.exp | 8 ++++++++
 2 files changed, 10 insertions(+), 1 deletion(-)

Comments

Andrew Burgess March 3, 2020, 1:39 p.m. UTC | #1 
* Sergio Durigan Junior <sergiodj@redhat.com> [2020-03-01 21:46:16 -0500]:

> Back at:
> 
> commit 1f6f6e21fa86dc3411a6498608f32e9eb24b7851
> Author: Philippe Waroquiers <philippe.waroquiers@skynet.be>
> Date:   Mon Jun 10 21:41:51 2019 +0200
> 
>     Ensure GDB printf command can print convenience var strings without a target.
> 
> GDB was extended in order to allow the printing of convenience
> variables that are strings without a target.  However, this introduced
> a regression that hasn't been caught by our testsuite (because there
> were no tests for it).
> 
> The problem happens when we try to print a convenience variable that
> holds the address of a string in the inferior.  The following
> two-liners can reproduce the issue:
> 
> $ echo -e 'int main(){const char a[]="test";return 0;}' | gcc -x c - -O0-g3
> $ ./gdb/gdb --data-directory ./gdb/data-directory -q ./a.out -ex 'start' -ex 'set $x = (const char *) (&a[0] + 2)' -ex 'printf "%s\n", $x'
> 
> After some investigation, I found that the problem happens on
> printcmd.c:printf_c_string.  In the case above, we're taking the first
> branch of the 'if' condition, which assumes that there will be a value
> to be printed at "value_contents (value)".  There isn't.  We actually
> need to obtain the address that the variable points to, and read the
> contents from memory.
> 
> It seems to me that we should avoid this branch if the TYPE_CODE of
> "value_type (value)" is TYPE_CODE_PTR (i.e., a pointer to the
> inferior's memory).  This is what this patch does.
> 
> I took the liberty to extend the current testcase under
> gdb.base/printcmds.exp and create a test that exercises this scenario.
> 
> No regressions have been found on Buildbot.
> 
> gdb/ChangeLog:
> 2020-03-02  Sergio Durigan Junior  <sergiodj@redhat.com>
> 
> 	* printcmd.c (print_c_string): Check also for TYPE_CODE_PTR
> 	when verifying if dealing with a convenience variable.
> 
> gdb/testsuite/ChangeLog:
> 2020-03-02  Sergio Durigan Junior  <sergiodj@redhat.com>
> 
> 	* gdb.base/printcmds.exp: Add test to verify printf of a
> 	variable holding an address.

LGTM.

Thanks,
Andrew


> ---
>  gdb/printcmd.c                       | 3 ++-
>  gdb/testsuite/gdb.base/printcmds.exp | 8 ++++++++
>  2 files changed, 10 insertions(+), 1 deletion(-)
> 
> diff --git a/gdb/printcmd.c b/gdb/printcmd.c
> index 797041484e..78d8d3d81e 100644
> --- a/gdb/printcmd.c
> +++ b/gdb/printcmd.c
> @@ -2260,7 +2260,8 @@ printf_c_string (struct ui_file *stream, const char *format,
>  {
>    const gdb_byte *str;
>  
> -  if (VALUE_LVAL (value) == lval_internalvar
> +  if (TYPE_CODE (value_type (value)) != TYPE_CODE_PTR
> +      && VALUE_LVAL (value) == lval_internalvar
>        && c_is_string_type_p (value_type (value)))
>      {
>        size_t len = TYPE_LENGTH (value_type (value));
> diff --git a/gdb/testsuite/gdb.base/printcmds.exp b/gdb/testsuite/gdb.base/printcmds.exp
> index bd2afc8696..c87a1517f0 100644
> --- a/gdb/testsuite/gdb.base/printcmds.exp
> +++ b/gdb/testsuite/gdb.base/printcmds.exp
> @@ -1039,6 +1039,14 @@ gdb_test_no_output "set may-call-functions off"
>  test_printf_convenience_var "with target, may-call-functions off"
>  gdb_test_no_output "set may-call-functions on"
>  
> +# Test printf of a variable that holds the address to a substring in
> +# the inferior.  This test will not work without a target.
> +gdb_test_no_output "set var \$test_substr = \(char \*\) \(&teststring\[0\] + 4\)" \
> +    "set \$test_substr var"
> +gdb_test "printf \"test_substr val = %s\\n\", \$test_substr" \
> +    "test_substr val = string contents" \
> +    "print \$test_substr"
> +
>  test_integer_literals_accepted
>  test_integer_literals_rejected
>  test_float_accepted
> -- 
> 2.24.1
>
Sergio Durigan Junior March 3, 2020, 4:29 p.m. UTC | #2 
On Tuesday, March 03 2020, Andrew Burgess wrote:

> * Sergio Durigan Junior <sergiodj@redhat.com> [2020-03-01 21:46:16 -0500]:
>
>> Back at:
>> 
>> commit 1f6f6e21fa86dc3411a6498608f32e9eb24b7851
>> Author: Philippe Waroquiers <philippe.waroquiers@skynet.be>
>> Date:   Mon Jun 10 21:41:51 2019 +0200
>> 
>>     Ensure GDB printf command can print convenience var strings without a target.
>> 
>> GDB was extended in order to allow the printing of convenience
>> variables that are strings without a target.  However, this introduced
>> a regression that hasn't been caught by our testsuite (because there
>> were no tests for it).
>> 
>> The problem happens when we try to print a convenience variable that
>> holds the address of a string in the inferior.  The following
>> two-liners can reproduce the issue:
>> 
>> $ echo -e 'int main(){const char a[]="test";return 0;}' | gcc -x c - -O0-g3
>> $ ./gdb/gdb --data-directory ./gdb/data-directory -q ./a.out -ex 'start' -ex 'set $x = (const char *) (&a[0] + 2)' -ex 'printf "%s\n", $x'
>> 
>> After some investigation, I found that the problem happens on
>> printcmd.c:printf_c_string.  In the case above, we're taking the first
>> branch of the 'if' condition, which assumes that there will be a value
>> to be printed at "value_contents (value)".  There isn't.  We actually
>> need to obtain the address that the variable points to, and read the
>> contents from memory.
>> 
>> It seems to me that we should avoid this branch if the TYPE_CODE of
>> "value_type (value)" is TYPE_CODE_PTR (i.e., a pointer to the
>> inferior's memory).  This is what this patch does.
>> 
>> I took the liberty to extend the current testcase under
>> gdb.base/printcmds.exp and create a test that exercises this scenario.
>> 
>> No regressions have been found on Buildbot.
>> 
>> gdb/ChangeLog:
>> 2020-03-02  Sergio Durigan Junior  <sergiodj@redhat.com>
>> 
>> 	* printcmd.c (print_c_string): Check also for TYPE_CODE_PTR
>> 	when verifying if dealing with a convenience variable.
>> 
>> gdb/testsuite/ChangeLog:
>> 2020-03-02  Sergio Durigan Junior  <sergiodj@redhat.com>
>> 
>> 	* gdb.base/printcmds.exp: Add test to verify printf of a
>> 	variable holding an address.
>
> LGTM.

Thanks, pushed:

7b973adce2b486518d3150db257b179e1b9a5d33
Sergio Durigan Junior March 3, 2020, 4:49 p.m. UTC | #3 
On Tuesday, March 03 2020, I wrote:

> On Tuesday, March 03 2020, Andrew Burgess wrote:
>
>> * Sergio Durigan Junior <sergiodj@redhat.com> [2020-03-01 21:46:16 -0500]:
>>
>>> Back at:
>>> 
>>> commit 1f6f6e21fa86dc3411a6498608f32e9eb24b7851
>>> Author: Philippe Waroquiers <philippe.waroquiers@skynet.be>
>>> Date:   Mon Jun 10 21:41:51 2019 +0200
>>> 
>>>     Ensure GDB printf command can print convenience var strings without a target.
>>> 
>>> GDB was extended in order to allow the printing of convenience
>>> variables that are strings without a target.  However, this introduced
>>> a regression that hasn't been caught by our testsuite (because there
>>> were no tests for it).
>>> 
>>> The problem happens when we try to print a convenience variable that
>>> holds the address of a string in the inferior.  The following
>>> two-liners can reproduce the issue:
>>> 
>>> $ echo -e 'int main(){const char a[]="test";return 0;}' | gcc -x c - -O0-g3
>>> $ ./gdb/gdb --data-directory ./gdb/data-directory -q ./a.out -ex 'start' -ex 'set $x = (const char *) (&a[0] + 2)' -ex 'printf "%s\n", $x'
>>> 
>>> After some investigation, I found that the problem happens on
>>> printcmd.c:printf_c_string.  In the case above, we're taking the first
>>> branch of the 'if' condition, which assumes that there will be a value
>>> to be printed at "value_contents (value)".  There isn't.  We actually
>>> need to obtain the address that the variable points to, and read the
>>> contents from memory.
>>> 
>>> It seems to me that we should avoid this branch if the TYPE_CODE of
>>> "value_type (value)" is TYPE_CODE_PTR (i.e., a pointer to the
>>> inferior's memory).  This is what this patch does.
>>> 
>>> I took the liberty to extend the current testcase under
>>> gdb.base/printcmds.exp and create a test that exercises this scenario.
>>> 
>>> No regressions have been found on Buildbot.
>>> 
>>> gdb/ChangeLog:
>>> 2020-03-02  Sergio Durigan Junior  <sergiodj@redhat.com>
>>> 
>>> 	* printcmd.c (print_c_string): Check also for TYPE_CODE_PTR
>>> 	when verifying if dealing with a convenience variable.
>>> 
>>> gdb/testsuite/ChangeLog:
>>> 2020-03-02  Sergio Durigan Junior  <sergiodj@redhat.com>
>>> 
>>> 	* gdb.base/printcmds.exp: Add test to verify printf of a
>>> 	variable holding an address.
>>
>> LGTM.
>
> Thanks, pushed:
>
> 7b973adce2b486518d3150db257b179e1b9a5d33

BTW, this also affects 9.1 (in fact, that's where I found the bug).  I
can create a tracking bug and backport it to the branch if the issue and
fix are deemed important enough.

Thanks,
Joel Brobecker March 4, 2020, 10:53 a.m. UTC | #4 
Hi Sergio,

> >>> gdb/ChangeLog:
> >>> 2020-03-02  Sergio Durigan Junior  <sergiodj@redhat.com>
> >>> 
> >>> 	* printcmd.c (print_c_string): Check also for TYPE_CODE_PTR
> >>> 	when verifying if dealing with a convenience variable.
> >>> 
> >>> gdb/testsuite/ChangeLog:
> >>> 2020-03-02  Sergio Durigan Junior  <sergiodj@redhat.com>
> >>> 
> >>> 	* gdb.base/printcmds.exp: Add test to verify printf of a
> >>> 	variable holding an address.
> >>
> >> LGTM.
> >
> > Thanks, pushed:
> >
> > 7b973adce2b486518d3150db257b179e1b9a5d33
> 
> BTW, this also affects 9.1 (in fact, that's where I found the bug).  I
> can create a tracking bug and backport it to the branch if the issue and
> fix are deemed important enough.

Do you know if this issue is a regression, compared to previous
released versions?

In terms of putting it in 9.2, I think we could do it; the patch
does look safe to me.
Sergio Durigan Junior March 6, 2020, 10:29 p.m. UTC | #5 
On Wednesday, March 04 2020, Joel Brobecker wrote:

> Hi Sergio,
>
>> >>> gdb/ChangeLog:
>> >>> 2020-03-02  Sergio Durigan Junior  <sergiodj@redhat.com>
>> >>> 
>> >>> 	* printcmd.c (print_c_string): Check also for TYPE_CODE_PTR
>> >>> 	when verifying if dealing with a convenience variable.
>> >>> 
>> >>> gdb/testsuite/ChangeLog:
>> >>> 2020-03-02  Sergio Durigan Junior  <sergiodj@redhat.com>
>> >>> 
>> >>> 	* gdb.base/printcmds.exp: Add test to verify printf of a
>> >>> 	variable holding an address.
>> >>
>> >> LGTM.
>> >
>> > Thanks, pushed:
>> >
>> > 7b973adce2b486518d3150db257b179e1b9a5d33
>> 
>> BTW, this also affects 9.1 (in fact, that's where I found the bug).  I
>> can create a tracking bug and backport it to the branch if the issue and
>> fix are deemed important enough.
>
> Do you know if this issue is a regression, compared to previous
> released versions?

Hey Joel,

Yeah, this is a regression.  GDB 8.3 worked fine.

> In terms of putting it in 9.2, I think we could do it; the patch
> does look safe to me.

Cool.  So, is the process the same (now that we're using a different
versioning scheme)?  Do I just open a bug again 9.1 and push the
backported patch to the branch?

Thanks,
diff mbox

Patch

diff --git a/gdb/printcmd.c b/gdb/printcmd.c
index 797041484e..78d8d3d81e 100644
--- a/gdb/printcmd.c
+++ b/gdb/printcmd.c
@@ -2260,7 +2260,8 @@  printf_c_string (struct ui_file *stream, const char *format,
 {
   const gdb_byte *str;
 
-  if (VALUE_LVAL (value) == lval_internalvar
+  if (TYPE_CODE (value_type (value)) != TYPE_CODE_PTR
+      && VALUE_LVAL (value) == lval_internalvar
       && c_is_string_type_p (value_type (value)))
     {
       size_t len = TYPE_LENGTH (value_type (value));
diff --git a/gdb/testsuite/gdb.base/printcmds.exp b/gdb/testsuite/gdb.base/printcmds.exp
index bd2afc8696..c87a1517f0 100644
--- a/gdb/testsuite/gdb.base/printcmds.exp
+++ b/gdb/testsuite/gdb.base/printcmds.exp
@@ -1039,6 +1039,14 @@  gdb_test_no_output "set may-call-functions off"
 test_printf_convenience_var "with target, may-call-functions off"
 gdb_test_no_output "set may-call-functions on"
 
+# Test printf of a variable that holds the address to a substring in
+# the inferior.  This test will not work without a target.
+gdb_test_no_output "set var \$test_substr = \(char \*\) \(&teststring\[0\] + 4\)" \
+    "set \$test_substr var"
+gdb_test "printf \"test_substr val = %s\\n\", \$test_substr" \
+    "test_substr val = string contents" \
+    "print \$test_substr"
+
 test_integer_literals_accepted
 test_integer_literals_rejected
 test_float_accepted