Re: [PATCH] gdb: fix possible use-after-free when executing commands

[Jan Vrany <jan.vrany@labware.com>]

Hi Simon,

> Hi Jan,
> > > 
> > > Do you think you could write a test to exercise that fix?
> > 
> > Maybe, though I'm not quite sure how to make it fail unless
> > one uses ASAN or Valgrind to run it like you do. Will give it 
> > stab. 
> > 
> > Jan
> 
> It's fine if it only fails with ASan / Valgrind enabled, that's the
> point of these tools.  They help catch bugs that would otherwise fly
> under the radar.
> 

Maybe something like the patch below?

With:

 * patch b5661ff2 ("gdb: fix possible use-after-free when executing commands")
   reverted,
 * patch below applied
 * and GDB compiled with ASan,

the new test fails for me. If I comment the redefinition:

diff --git a/gdb/testsuite/gdb.python/py-cmd.exp b/gdb/testsuite/gdb.python/py-cmd.exp
index ce26f2d3040..ed628e77d31 100644
--- a/gdb/testsuite/gdb.python/py-cmd.exp
+++ b/gdb/testsuite/gdb.python/py-cmd.exp
@@ -82,7 +82,7 @@ gdb_test_multiline "input command redefining itself" \
   "  def invoke (self, arg, from_tty):" "" \
   "    print (\"redefine_cmd output, msg = %s\" % self._msg)" "" \
   "    self._msg = arg" "" \
-  "    redefine_cmd (arg)" "" \
+  "    #redefine_cmd (arg)" "" \
   "redefine_cmd (\"XXX\")" "" \
   "end" ""

the test start to pass (since it is not redefining itself).

HTH, Jan

-- >8 --
Subject: [PATCH] gdb/testsuite: add test for Python commands redefining itself

This commit add test that creates a Python command that redefines
itself during its execution. This is to test use-after-free in
execute_command ().

This test needs run with ASan enabled in order to fail when it
should.
---
 gdb/testsuite/gdb.python/py-cmd.exp | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/gdb/testsuite/gdb.python/py-cmd.exp b/gdb/testsuite/gdb.python/py-cmd.exp
index aa95a459f46..ce26f2d3040 100644
--- a/gdb/testsuite/gdb.python/py-cmd.exp
+++ b/gdb/testsuite/gdb.python/py-cmd.exp
@@ -71,6 +71,29 @@ gdb_test_multiline "input subcommand" \
 
 gdb_test "prefix_cmd subcmd ugh" "subcmd output, arg = ugh" "call subcmd"
 
+# Test command redefining itself
+
+gdb_test_multiline "input command redefining itself" \
+  "python" "" \
+  "class redefine_cmd (gdb.Command):" "" \
+  "  def __init__ (self, msg):" "" \
+  "    super (redefine_cmd, self).__init__ (\"redefine_cmd\", gdb.COMMAND_OBSCURE)" "" \
+  "    self._msg = msg" "" \
+  "  def invoke (self, arg, from_tty):" "" \
+  "    print (\"redefine_cmd output, msg = %s\" % self._msg)" "" \
+  "    self._msg = arg" "" \
+  "    redefine_cmd (arg)" "" \
+  "redefine_cmd (\"XXX\")" "" \
+  "end" ""
+
+gdb_test "redefine_cmd AAA" \
+  "redefine_cmd output, msg = XXX" \
+  "call command redefining itself 1"
+
+gdb_test "redefine_cmd BBB" \
+  "redefine_cmd output, msg = AAA" \
+  "call command redefining itself 2"
+
 # Test prefix command using keyword arguments.
 
 gdb_test_multiline "input prefix command, keyword arguments" \
-- 
2.35.1