public inbox for gdb-patches@sourceware.org
 help / color / mirror / Atom feed
From: Tom Tromey <tom@tromey.com>
To: Jan Vrany via Gdb-patches <gdb-patches@sourceware.org>
Cc: Jan Vrany <jan.vrany@labware.com>
Subject: Re: [PATCH] gdb: fix possible use-after-free when executing commands
Date: Fri, 09 Dec 2022 10:55:14 -0700	[thread overview]
Message-ID: <87pmcsh37h.fsf@tromey.com> (raw)
In-Reply-To: <20221208142014.84759-1-jan.vrany@labware.com> (Jan Vrany via Gdb-patches's message of "Thu, 8 Dec 2022 14:20:14 +0000")

>>>>> "Jan" == Jan Vrany via Gdb-patches <gdb-patches@sourceware.org> writes:

Jan> This may lead into use-after-free error.  Imagine the command
Jan> being executed is a user-defined Python command that redefines
Jan> itself.  In that case, struct `cmd_list_element` pointed to by
Jan> `c` is deallocated during its execution so it is no longer valid
Jan> when post hook is executed.

Thanks for the patch.

Your analysis makes sense to me.  I wouldn't be surprised if there were
other issues along these lines.  Or if this were in bugzilla somewhere.

Jan> +      std::string c_name(c->name);

Space before the paren.  Also I think a comment here explaining why it's
needed would be good.

Jan>        /* If this command has been post-hooked, run the hook last.  */
Jan> -      execute_cmd_post_hook (c);
Jan> +      c = lookup_cmd_exact (c_name.c_str (), cmdlist);
Jan> +      if (c != nullptr)
Jan> +	execute_cmd_post_hook (c);
 
Perhaps a comment here as well explaining the need to redo the lookup.

This is ok with these minor changes.

thanks,
Tom

  reply	other threads:[~2022-12-09 17:55 UTC|newest]

Thread overview: 31+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-12-08 14:20 Jan Vrany
2022-12-09 17:55 ` Tom Tromey [this message]
2022-12-12 15:05   ` Luis Machado
2022-12-12 15:08     ` Jan Vraný
2022-12-12 15:09     ` Luis Machado
2022-12-13 11:22     ` [PATCH] gdb: fix command lookup in execute_command () Jan Vrany
2022-12-13 15:05       ` Tom Tromey
2022-12-13 16:43         ` Simon Marchi
2022-12-13 18:48         ` Jan Vraný
2022-12-13 19:29           ` Simon Marchi
2022-12-14 11:07             ` [PATCH] gdb: fix command lookup in execute_command () commands" Jan Vrany
2022-12-14 15:35               ` Simon Marchi
2022-12-14 15:41                 ` Jan Vraný
2022-12-14 15:59               ` Tom Tromey
2022-12-14 16:01                 ` Simon Marchi
2022-12-14 18:05                   ` Tom Tromey
2022-12-14 18:30                     ` Simon Marchi
2022-12-14 22:01                       ` Simon Marchi
2022-12-16 14:07             ` [PATCH] gdb: fix command lookup in execute_command () Jan Vraný
2022-12-16 16:47               ` Simon Marchi
2022-12-19 11:48                 ` Jan Vraný
2022-12-19 14:46                   ` Tom Tromey
2022-12-19 15:51                     ` Jan Vraný
2022-12-20 19:10                       ` Tom Tromey
2022-12-14 19:52 ` [PATCH] gdb: fix possible use-after-free when executing commands Simon Marchi
2022-12-14 20:39   ` Jan Vraný
2022-12-14 20:42     ` Simon Marchi
2022-12-15 12:57       ` Jan Vrany
2022-12-15 13:53         ` Simon Marchi
2022-12-15 14:51           ` Jan Vrany
2022-12-15 16:00             ` Simon Marchi

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=87pmcsh37h.fsf@tromey.com \
    --to=tom@tromey.com \
    --cc=gdb-patches@sourceware.org \
    --cc=jan.vrany@labware.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).