REDHAT-BUG-2565676: Buffer Overflow
Stack buffer overflow in remotetarget::fetchregisterusingp (gdb/remote.c). The function allocates a stack buffer via alloca(registersize) then decodes the stub's p-reply into it with a loop that terminates only on NUL, without bounding writes by registersize. A malicious RSP stub sends an oversized p-reply to overflow the stack buffer and overwrite the saved return address. The same primitive — with a reply shorter than registersize — leaks stack bytes via rawsupply, enabling canary and ASLR disclosure from the same connection.