Re: [PATCH] gdb: fix possible use-after-free when executing commands

[Simon Marchi <simark@simark.ca>]

On 12/14/22 15:39, Jan Vraný wrote:
> On Wed, 2022-12-14 at 14:52 -0500, Simon Marchi wrote:
>>
>> On 12/8/22 09:20, Jan Vrany via Gdb-patches wrote:
>>> In principle, `execute_command()` does following:
>>>
>>>    struct cmd_list_element *c;
>>>    c = lookup_cmd ( ... );
>>>    ...
>>>    /* If this command has been pre-hooked, run the hook first.  */
>>>    execute_cmd_pre_hook (c);
>>>    ...
>>>    /* ...execute the command `c` ...*/
>>>    ...
>>>    execute_cmd_post_hook (c);
>>>
>>> This may lead into use-after-free error.  Imagine the command
>>> being executed is a user-defined Python command that redefines
>>> itself.  In that case, struct `cmd_list_element` pointed to by
>>> `c` is deallocated during its execution so it is no longer valid
>>> when post hook is executed.
>>>
>>> To fix this case, this commit looks up the command once again
>>> after it is executed to get pointer to (possibly newly allocated)
>>> `cmd_list_element`.
>>
>> Hi Jan,
>>
>> Do you think you could write a test to exercise that fix?
> 
> Maybe, though I'm not quite sure how to make it fail unless
> one uses ASAN or Valgrind to run it like you do. Will give it 
> stab. 
> 
> Jan

It's fine if it only fails with ASan / Valgrind enabled, that's the
point of these tools.  They help catch bugs that would otherwise fly
under the radar.

Simon