From: "Jan Vraný" <Jan.Vrany@labware.com>
To: "gdb-patches@sourceware.org" <gdb-patches@sourceware.org>,
"tom@tromey.com" <tom@tromey.com>,
"luis.machado@arm.com" <luis.machado@arm.com>
Subject: Re: [PATCH] gdb: fix possible use-after-free when executing commands
Date: Mon, 12 Dec 2022 15:08:10 +0000 [thread overview]
Message-ID: <3ddb87839c655f195826754b9775b3dc04dc8d77.camel@labware.com> (raw)
In-Reply-To: <1a96057b-afd6-1e90-15c9-ee106a2998c7@arm.com>
On Mon, 2022-12-12 at 15:05 +0000, Luis Machado wrote:
> Hi,
>
> On 12/9/22 17:55, Tom Tromey wrote:
> > > > > > > "Jan" == Jan Vrany via Gdb-patches <gdb-patches@sourceware.org> writes:
> >
> > Jan> This may lead into use-after-free error. Imagine the command
> > Jan> being executed is a user-defined Python command that redefines
> > Jan> itself. In that case, struct `cmd_list_element` pointed to by
> > Jan> `c` is deallocated during its execution so it is no longer valid
> > Jan> when post hook is executed.
> >
> > Thanks for the patch.
> >
> > Your analysis makes sense to me. I wouldn't be surprised if there were
> > other issues along these lines. Or if this were in bugzilla somewhere.
> >
> > Jan> + std::string c_name(c->name);
> >
> > Space before the paren. Also I think a comment here explaining why it's
> > needed would be good.
> >
> > Jan> /* If this command has been post-hooked, run the hook last. */
> > Jan> - execute_cmd_post_hook (c);
> > Jan> + c = lookup_cmd_exact (c_name.c_str (), cmdlist);
> > Jan> + if (c != nullptr)
> > Jan> + execute_cmd_post_hook (c);
> >
> > Perhaps a comment here as well explaining the need to redo the lookup.
> >
> > This is ok with these minor changes.
> >
> > thanks,
> > Tom
>
> I've spotted gdb.base/define.exp failing today, and bisection stopped in this particular
> patch.
>
> target testsuite
> one
> hello
> (gdb) FAIL: gdb.base/define.exp: target testsuite with hooks
Ouch, I'll have a look ASAP.
Jan
>
next prev parent reply other threads:[~2022-12-12 15:08 UTC|newest]
Thread overview: 31+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-12-08 14:20 Jan Vrany
2022-12-09 17:55 ` Tom Tromey
2022-12-12 15:05 ` Luis Machado
2022-12-12 15:08 ` Jan Vraný [this message]
2022-12-12 15:09 ` Luis Machado
2022-12-13 11:22 ` [PATCH] gdb: fix command lookup in execute_command () Jan Vrany
2022-12-13 15:05 ` Tom Tromey
2022-12-13 16:43 ` Simon Marchi
2022-12-13 18:48 ` Jan Vraný
2022-12-13 19:29 ` Simon Marchi
2022-12-14 11:07 ` [PATCH] gdb: fix command lookup in execute_command () commands" Jan Vrany
2022-12-14 15:35 ` Simon Marchi
2022-12-14 15:41 ` Jan Vraný
2022-12-14 15:59 ` Tom Tromey
2022-12-14 16:01 ` Simon Marchi
2022-12-14 18:05 ` Tom Tromey
2022-12-14 18:30 ` Simon Marchi
2022-12-14 22:01 ` Simon Marchi
2022-12-16 14:07 ` [PATCH] gdb: fix command lookup in execute_command () Jan Vraný
2022-12-16 16:47 ` Simon Marchi
2022-12-19 11:48 ` Jan Vraný
2022-12-19 14:46 ` Tom Tromey
2022-12-19 15:51 ` Jan Vraný
2022-12-20 19:10 ` Tom Tromey
2022-12-14 19:52 ` [PATCH] gdb: fix possible use-after-free when executing commands Simon Marchi
2022-12-14 20:39 ` Jan Vraný
2022-12-14 20:42 ` Simon Marchi
2022-12-15 12:57 ` Jan Vrany
2022-12-15 13:53 ` Simon Marchi
2022-12-15 14:51 ` Jan Vrany
2022-12-15 16:00 ` Simon Marchi
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=3ddb87839c655f195826754b9775b3dc04dc8d77.camel@labware.com \
--to=jan.vrany@labware.com \
--cc=gdb-patches@sourceware.org \
--cc=luis.machado@arm.com \
--cc=tom@tromey.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).