public inbox for gdb-patches@sourceware.org
 help / color / mirror / Atom feed
From: Jan Vrany <jan.vrany@labware.com>
To: gdb-patches@sourceware.org
Cc: Jan Vrany <jan.vrany@labware.com>
Subject: [PATCH] gdb: fix possible use-after-free when executing commands
Date: Thu,  8 Dec 2022 14:20:14 +0000	[thread overview]
Message-ID: <20221208142014.84759-1-jan.vrany@labware.com> (raw)

In principle, `execute_command()` does following:

   struct cmd_list_element *c;
   c = lookup_cmd ( ... );
   ...
   /* If this command has been pre-hooked, run the hook first.  */
   execute_cmd_pre_hook (c);
   ...
   /* ...execute the command `c` ...*/
   ...
   execute_cmd_post_hook (c);

This may lead into use-after-free error.  Imagine the command
being executed is a user-defined Python command that redefines
itself.  In that case, struct `cmd_list_element` pointed to by
`c` is deallocated during its execution so it is no longer valid
when post hook is executed.

To fix this case, this commit looks up the command once again
after it is executed to get pointer to (possibly newly allocated)
`cmd_list_element`.
---
 gdb/top.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/gdb/top.c b/gdb/top.c
index e9794184f07..441ca3e14c1 100644
--- a/gdb/top.c
+++ b/gdb/top.c
@@ -655,6 +655,8 @@ execute_command (const char *p, int from_tty)
 	    }
 	}
 
+      std::string c_name(c->name);
+
       /* If this command has been pre-hooked, run the hook first.  */
       execute_cmd_pre_hook (c);
 
@@ -694,7 +696,9 @@ execute_command (const char *p, int from_tty)
       maybe_wait_sync_command_done (was_sync);
 
       /* If this command has been post-hooked, run the hook last.  */
-      execute_cmd_post_hook (c);
+      c = lookup_cmd_exact (c_name.c_str (), cmdlist);
+      if (c != nullptr)
+	execute_cmd_post_hook (c);
 
       if (repeat_arguments != NULL && cmd_start == saved_command_line)
 	{
-- 
2.35.1


             reply	other threads:[~2022-12-08 14:20 UTC|newest]

Thread overview: 31+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-12-08 14:20 Jan Vrany [this message]
2022-12-09 17:55 ` Tom Tromey
2022-12-12 15:05   ` Luis Machado
2022-12-12 15:08     ` Jan Vraný
2022-12-12 15:09     ` Luis Machado
2022-12-13 11:22     ` [PATCH] gdb: fix command lookup in execute_command () Jan Vrany
2022-12-13 15:05       ` Tom Tromey
2022-12-13 16:43         ` Simon Marchi
2022-12-13 18:48         ` Jan Vraný
2022-12-13 19:29           ` Simon Marchi
2022-12-14 11:07             ` [PATCH] gdb: fix command lookup in execute_command () commands" Jan Vrany
2022-12-14 15:35               ` Simon Marchi
2022-12-14 15:41                 ` Jan Vraný
2022-12-14 15:59               ` Tom Tromey
2022-12-14 16:01                 ` Simon Marchi
2022-12-14 18:05                   ` Tom Tromey
2022-12-14 18:30                     ` Simon Marchi
2022-12-14 22:01                       ` Simon Marchi
2022-12-16 14:07             ` [PATCH] gdb: fix command lookup in execute_command () Jan Vraný
2022-12-16 16:47               ` Simon Marchi
2022-12-19 11:48                 ` Jan Vraný
2022-12-19 14:46                   ` Tom Tromey
2022-12-19 15:51                     ` Jan Vraný
2022-12-20 19:10                       ` Tom Tromey
2022-12-14 19:52 ` [PATCH] gdb: fix possible use-after-free when executing commands Simon Marchi
2022-12-14 20:39   ` Jan Vraný
2022-12-14 20:42     ` Simon Marchi
2022-12-15 12:57       ` Jan Vrany
2022-12-15 13:53         ` Simon Marchi
2022-12-15 14:51           ` Jan Vrany
2022-12-15 16:00             ` Simon Marchi

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20221208142014.84759-1-jan.vrany@labware.com \
    --to=jan.vrany@labware.com \
    --cc=gdb-patches@sourceware.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).