Re: [PATCH] gdb: fix possible use-after-free when executing commands

[Simon Marchi <simark@simark.ca>]

On 12/15/22 07:57, Jan Vrany via Gdb-patches wrote:
> Hi Simon,
> 
>> Hi Jan,
>>>>
>>>> Do you think you could write a test to exercise that fix?
>>>
>>> Maybe, though I'm not quite sure how to make it fail unless
>>> one uses ASAN or Valgrind to run it like you do. Will give it 
>>> stab. 
>>>
>>> Jan
>>
>> It's fine if it only fails with ASan / Valgrind enabled, that's the
>> point of these tools.  They help catch bugs that would otherwise fly
>> under the radar.
>>
> 
> Maybe something like the patch below?

Thanks for following up!

> 
> With:
> 
>  * patch b5661ff2 ("gdb: fix possible use-after-free when executing commands")
>    reverted,
>  * patch below applied
>  * and GDB compiled with ASan,
> 
> the new test fails for me. If I comment the redefinition:
> 
> diff --git a/gdb/testsuite/gdb.python/py-cmd.exp b/gdb/testsuite/gdb.python/py-cmd.exp
> index ce26f2d3040..ed628e77d31 100644
> --- a/gdb/testsuite/gdb.python/py-cmd.exp
> +++ b/gdb/testsuite/gdb.python/py-cmd.exp
> @@ -82,7 +82,7 @@ gdb_test_multiline "input command redefining itself" \
>    "  def invoke (self, arg, from_tty):" "" \
>    "    print (\"redefine_cmd output, msg = %s\" % self._msg)" "" \
>    "    self._msg = arg" "" \
> -  "    redefine_cmd (arg)" "" \
> +  "    #redefine_cmd (arg)" "" \
>    "redefine_cmd (\"XXX\")" "" \
>    "end" ""
> 
> the test start to pass (since it is not redefining itself).
> 
> HTH, Jan
> 
> -- >8 --
> Subject: [PATCH] gdb/testsuite: add test for Python commands redefining itself
> 
> This commit add test that creates a Python command that redefines

"add" -> "adds a"

> itself during its execution. This is to test use-after-free in
> execute_command ().
> 
> This test needs run with ASan enabled in order to fail when it
> should.
> ---
>  gdb/testsuite/gdb.python/py-cmd.exp | 23 +++++++++++++++++++++++
>  1 file changed, 23 insertions(+)
> 
> diff --git a/gdb/testsuite/gdb.python/py-cmd.exp b/gdb/testsuite/gdb.python/py-cmd.exp
> index aa95a459f46..ce26f2d3040 100644
> --- a/gdb/testsuite/gdb.python/py-cmd.exp
> +++ b/gdb/testsuite/gdb.python/py-cmd.exp
> @@ -71,6 +71,29 @@ gdb_test_multiline "input subcommand" \
>  
>  gdb_test "prefix_cmd subcmd ugh" "subcmd output, arg = ugh" "call subcmd"
>  
> +# Test command redefining itself
> +
> +gdb_test_multiline "input command redefining itself" \
> +  "python" "" \
> +  "class redefine_cmd (gdb.Command):" "" \
> +  "  def __init__ (self, msg):" "" \
> +  "    super (redefine_cmd, self).__init__ (\"redefine_cmd\", gdb.COMMAND_OBSCURE)" "" \
> +  "    self._msg = msg" "" \
> +  "  def invoke (self, arg, from_tty):" "" \
> +  "    print (\"redefine_cmd output, msg = %s\" % self._msg)" "" \
> +  "    self._msg = arg" "" \

Is it needed to assign arg to self._msg here?

> +  "    redefine_cmd (arg)" "" \
> +  "redefine_cmd (\"XXX\")" "" \
> +  "end" ""
> +
> +gdb_test "redefine_cmd AAA" \
> +  "redefine_cmd output, msg = XXX" \
> +  "call command redefining itself 1"
> +
> +gdb_test "redefine_cmd BBB" \
> +  "redefine_cmd output, msg = AAA" \
> +  "call command redefining itself 2"
> +

Note that in TCL code, we use an indent of 4 columns (and just like with
C++ code, whole groups of 8 columns become a tab).

In order to isolate the new test from the other tests in the file, can
you put the new test into its own `proc_with_prefix` function, and start
with a fresh GDB?  That would mean calling clean_restart at the
beginning of the proc.

Simon