From: Tom Tromey <tromey@adacore.com>
Date: Fri, 14 Nov 2025 20:40:22 +0000 (-0700)
Subject: Fix crash from eval_op_objc_msgcall
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=9603180dd2b1d0831aa983ed4ab09d5760fac08b;p=thirdparty%2Fbinutils-gdb.git

Fix crash from eval_op_objc_msgcall

Trying to evaluate an Objective-C message call will cause gdb to
crash.  This happens because this code was not correctly updated when
call_function_by_hand was changed to accept an array_view, and the
trailing NULL pointer was no longer required.

Bug: https://sourceware.org/bugzilla/show_bug.cgi?id=33628
---

diff --git a/gdb/eval.c b/gdb/eval.c
index 5455164dc63..5d1907f837e 100644
--- a/gdb/eval.c
+++ b/gdb/eval.c
@@ -1909,8 +1909,7 @@ eval_binop_assign_modify (struct type *expect_type, struct expression *exp,
   return value_assign (arg1, arg2);
 }
 
-/* Note that ARGS needs 2 empty slots up front and must end with a
-   null pointer.  */
+/* Note that ARGS needs 2 empty slots up front.  */
 static struct value *
 eval_op_objc_msgcall (struct type *expect_type, struct expression *exp,
 		      enum noside noside, CORE_ADDR selector,
@@ -2240,17 +2239,16 @@ objc_msgcall_operation::evaluate (struct type *expect_type,
   else
     sub_no_side = noside;
   std::vector<operation_up> &args = std::get<2> (m_storage);
-  value **argvec = XALLOCAVEC (struct value *, args.size () + 3);
+  value **argvec = XALLOCAVEC (struct value *, args.size () + 2);
   argvec[0] = nullptr;
   argvec[1] = nullptr;
   for (int i = 0; i < args.size (); ++i)
     argvec[i + 2] = args[i]->evaluate_with_coercion (exp, sub_no_side);
-  argvec[args.size () + 2] = nullptr;
 
   return eval_op_objc_msgcall (expect_type, exp, noside, std::
 			       get<0> (m_storage), target,
 			       gdb::make_array_view (argvec,
-						     args.size () + 3));
+						     args.size () + 2));
 }
 
 value *