Mailing List Archive

[Bug 3085] seccomp issue after upgrading openssl
https://bugzilla.mindrot.org/show_bug.cgi?id=3085

Ahmed Sayeed <ahmedsayeed1982@yahoo.com> changed:

What |Removed |Added
----------------------------------------------------------------------------
CC| |ahmedsayeed1982@yahoo.com

--- Comment #33 from Ahmed Sayeed <ahmedsayeed1982@yahoo.com> ---
gdb: fix value_subscript when array upper bound is not known
http://www-look-4.com/category/health/

Since commit 7c6f27129631 ("gdb: make get_discrete_bounds check for
https://komiya-dental.com/category/crypto/
non-constant range bounds"), subscripting flexible array member
fails:
http://www.iu-bloomington.com/category/health/
struct no_size
{ https://waytowhatsnext.com/category/health/
int n;
int items[];
};
http://www.wearelondonmade.com/category/health/
(gdb) p *ns
$1 = {n = 3, items = 0x5555555592a4}
(gdb) p ns->items[0] http://www.jopspeech.com/category/health/
Cannot access memory at address 0xfffe555b733a0164
(gdb) p *((int *) 0x5555555592a4)
$2 = 101 <--- we would expect that
http://joerg.li/category/health/
(gdb) p &ns->items[0]
$3 = (int *) 0xfffe5559ee829a24 <--- wrong address
http://connstr.net/category/health/

Since the flexible array member (items) has an unspecified size,
the array type
created for it in the DWARF doesn't have dimensions (this is with
gcc 9.3.0, http://embermanchester.uk/category/health/
Ubuntu 20.04):
http://www.slipstone.co.uk/category/health/
0x000000a4: DW_TAG_array_type
DW_AT_type [DW_FORM_ref4] (0x00000038
"int")
DW_AT_sibling [DW_FORM_ref4] (0x000000b3)
http://www.logoarts.co.uk/category/health/

0x000000ad: DW_TAG_subrange_type
DW_AT_type [DW_FORM_ref4] (0x00000031
"long unsigned int")
http://www.acpirateradio.co.uk/category/health/
This causes GDB to create a range type (TYPE_CODE_RANGE) with a
defined
constant low bound (dynamic _prop with kind PROP_CONST) and an
undefined
high bound (dynamic_prop with kind PROP_UNDEFINED).
http://www.compilatori.com/category/health/

value_subscript gets both bounds of that range using
get_discrete_bounds. Before commit 7c6f27129631,
get_discrete_bounds
didn't check the kind of the dynamic_props and would just blindly
read
them as if they were PROP_CONST.
https://www.webb-dev.co.uk/category/health/ It would return 0 for the
high bound,
because we zero-initialize the range_bounds structure. And it
didn't
really matter in this case, because the returned high bound wasn't
used
in the end.

--
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.
_______________________________________________
openssh-bugs mailing list
openssh-bugs@mindrot.org
https://lists.mindrot.org/mailman/listinfo/openssh-bugs