From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 48552 invoked by alias); 3 May 2016 11:22:06 -0000 Mailing-List: contact gdb-patches-help@sourceware.org; run by ezmlm Precedence: bulk List-Id: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: gdb-patches-owner@sourceware.org Received: (qmail 48489 invoked by uid 89); 3 May 2016 11:22:05 -0000 Authentication-Results: sourceware.org; auth=none X-Virus-Found: No X-Spam-SWARE-Status: No, score=-2.9 required=5.0 tests=BAYES_00,RP_MATCHES_RCVD,SPF_HELO_PASS autolearn=ham version=3.3.2 spammy=useafterfree, use-after-free X-HELO: mx1.redhat.com Received: from mx1.redhat.com (HELO mx1.redhat.com) (209.132.183.28) by sourceware.org (qpsmtpd/0.93/v0.84-503-g423c35a) with (AES256-GCM-SHA384 encrypted) ESMTPS; Tue, 03 May 2016 11:21:54 +0000 Received: from int-mx14.intmail.prod.int.phx2.redhat.com (int-mx14.intmail.prod.int.phx2.redhat.com [10.5.11.27]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 91F26C01AA33 for ; Tue, 3 May 2016 11:21:53 +0000 (UTC) Received: from cascais.lan (ovpn01.gateway.prod.ext.phx2.redhat.com [10.5.9.1]) by int-mx14.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id u43BLp1i010518 for ; Tue, 3 May 2016 07:21:52 -0400 From: Pedro Alves To: gdb-patches@sourceware.org Subject: [ob/pushed+7.11 2/2] Fix gdb/python/python.c use-after-free Date: Tue, 03 May 2016 11:22:00 -0000 Message-Id: <1462274511-2554-2-git-send-email-palves@redhat.com> In-Reply-To: <1462274511-2554-1-git-send-email-palves@redhat.com> References: <1462274511-2554-1-git-send-email-palves@redhat.com> X-SW-Source: 2016-05/txt/msg00033.txt.bz2 Valgrind shows: ==26964== Invalid read of size 1 ==26964== at 0x6E14100: __GI_strcmp (strcmp.S:180) ==26964== by 0x6DB55AA: setlocale (setlocale.c:238) ==26964== by 0x4E0455: _initialize_python() (python.c:1731) ==26964== by 0x786731: initialize_all_files() (init.c:319) ==26964== by 0x72EF0A: gdb_init(char*) (top.c:1929) ==26964== by 0x60BCAC: captured_main(void*) (main.c:863) ==26964== by 0x606AD5: catch_errors(int (*)(void*), void*, char*, return_mask) (exceptions.c:234) ==26964== by 0x60C608: gdb_main(captured_main_args*) (main.c:1165) ==26964== by 0x40CAEC: main (gdb.c:32) ==26964== Address 0x81d30a0 is 0 bytes inside a block of size 181 free'd ==26964== at 0x4C29CF0: free (vg_replace_malloc.c:530) ==26964== by 0x6DB5B65: setname (setlocale.c:201) ==26964== by 0x6DB5B65: setlocale (setlocale.c:388) ==26964== by 0x4E037F: _initialize_python() (python.c:1712) ==26964== by 0x786731: initialize_all_files() (init.c:319) ==26964== by 0x72EF0A: gdb_init(char*) (top.c:1929) ==26964== by 0x60BCAC: captured_main(void*) (main.c:863) ==26964== by 0x606AD5: catch_errors(int (*)(void*), void*, char*, return_mask) (exceptions.c:234) ==26964== by 0x60C608: gdb_main(captured_main_args*) (main.c:1165) ==26964== by 0x40CAEC: main (gdb.c:32) The problem is doing this: oldloc = setlocale (LC_ALL, NULL); setlocale (LC_ALL, ""); ... setlocale (LC_ALL, oldloc); I.e., the second setlocale call frees 'oldloc'. >From http://pubs.opengroup.org/onlinepubs/9699919799/functions/setlocale.html : "The returned string pointer might be invalidated or the string content might be overwritten by a subsequent call to setlocale()." gdb/ChangeLog: 2016-05-03 Pedro Alves PR python/20037 * python/python.c (_initialize_python) [IS_PY3K]: xstrdup/xfree oldloc. --- gdb/ChangeLog | 6 ++++++ gdb/python/python.c | 5 ++++- 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/gdb/ChangeLog b/gdb/ChangeLog index c5b7325..8627cb7 100644 --- a/gdb/ChangeLog +++ b/gdb/ChangeLog @@ -1,5 +1,11 @@ 2016-05-03 Pedro Alves + PR python/20037 + * python/python.c (_initialize_python) [IS_PY3K]: xstrdup/xfree + oldloc. + +2016-05-03 Pedro Alves + * python/python.c (_initialize_python) [IS_PY3K]: Remove dead code. diff --git a/gdb/python/python.c b/gdb/python/python.c index ea9cf85..c706644 100644 --- a/gdb/python/python.c +++ b/gdb/python/python.c @@ -1708,22 +1708,25 @@ message == an error message without a stack will be printed."), progname = concat (ldirname (python_libdir), SLASH_STRING, "bin", SLASH_STRING, "python", (char *) NULL); #ifdef IS_PY3K - oldloc = setlocale (LC_ALL, NULL); + oldloc = xstrdup (setlocale (LC_ALL, NULL)); setlocale (LC_ALL, ""); progsize = strlen (progname); progname_copy = (wchar_t *) PyMem_Malloc ((progsize + 1) * sizeof (wchar_t)); if (!progname_copy) { + xfree (oldloc); fprintf (stderr, "out of memory\n"); return; } count = mbstowcs (progname_copy, progname, progsize + 1); if (count == (size_t) -1) { + xfree (oldloc); fprintf (stderr, "Could not convert python path to string\n"); return; } setlocale (LC_ALL, oldloc); + xfree (oldloc); /* Note that Py_SetProgramName expects the string it is passed to remain alive for the duration of the program's execution, so -- 2.5.5