Re: [PATCH] gdb: fix command lookup in execute_command () commands"

[Simon Marchi <simark@simark.ca>]

On 12/14/22 13:30, Simon Marchi via Gdb-patches wrote:
> 
> 
> On 12/14/22 13:05, Tom Tromey wrote:
>> Simon> Do you have ASan enabled in that build?
>>
>> Nope, but I tried it and I was able to reproduce the problem.
>> I should have thought of that earlier :{
>>
>> Tom
> 
> I think the problem is the static buffer used in command_line_input.
> 
> The "define set xxx_yyy" command is read into the static buffer here:
> 
>     #5 0x564a50c93555 in command_line_input(char const*, char const*) /home/smarchi/src/binutils-gdb/gdb/top.c:1421
>     #6 0x564a50c8c1b2 in read_command_file(_IO_FILE*) /home/smarchi/src/binutils-gdb/gdb/top.c:458
>     #7 0x564a4ed1ea61 in script_from_file(_IO_FILE*, char const*) /home/smarchi/src/binutils-gdb/gdb/cli/cli-script.c:1638
>     #8 0x564a4ec4cff3 in source_script_from_stream /home/smarchi/src/binutils-gdb/gdb/cli/cli-cmds.c:728
>     #9 0x564a4ec4d43b in source_script_with_search /home/smarchi/src/binutils-gdb/gdb/cli/cli-cmds.c:773
>     #10 0x564a4ec4da65 in source_command /home/smarchi/src/binutils-gdb/gdb/cli/cli-cmds.c:831
> 
> That same buffer is used for reading the lines inside the define, here:
> 
>     #5 0x564a50c93555 in command_line_input(char const*, char const*) /home/smarchi/src/binutils-gdb/gdb/top.c:1421
>     #6 0x564a4ed0cc32 in read_next_line /home/smarchi/src/binutils-gdb/gdb/cli/cli-script.c:920
>     #7 0x564a4ed286f6 in gdb::function_view<char const* ()>::bind<char const*>(char const* (*)())::{lambda(gdb::fv_detail::erased_callable)#1}::operator()(gdb::fv_detail::erased_callable) const /home/smarchi/src/binutils-gdb/gdb/../gdbsupport/function-view.h:326
>     #8 0x564a4ed28772 in gdb::function_view<char const* ()>::bind<char const*>(char const* (*)())::{lambda(gdb::fv_detail::erased_callable)#1}::_FUN(gdb::fv_detail::erased_callable) /home/smarchi/src/binutils-gdb/gdb/../gdbsupport/function-view.h:320
>     #9 0x564a4ed25288 in gdb::function_view<char const* ()>::operator()() const /home/smarchi/src/binutils-gdb/gdb/../gdbsupport/function-view.h:289
>     #10 0x564a4ed1adf2 in read_command_lines_1(gdb::function_view<char const* ()>, int, gdb::function_view<void (char const*)>) /home/smarchi/src/binutils-gdb/gdb/cli/cli-script.c:1234
>     #11 0x564a4ed1a997 in read_command_lines(char const*, int, int, gdb::function_view<void (char const*)>) /home/smarchi/src/binutils-gdb/gdb/cli/cli-script.c:1202
>     #12 0x564a4ed1c8e6 in do_define_command /home/smarchi/src/binutils-gdb/gdb/cli/cli-script.c:1450
>     #13 0x564a4ed1d2bc in define_command /home/smarchi/src/binutils-gdb/gdb/cli/cli-script.c:1500
>     #14 0x564a4ec82cbc in do_simple_func /home/smarchi/src/binutils-gdb/gdb/cli/cli-decode.c:95
>     #15 0x564a4ec99059 in cmd_func(cmd_list_element*, char const*, int) /home/smarchi/src/binutils-gdb/gdb/cli/cli-decode.c:2543
>     #16 0x564a50c8e30d in execute_command(char const*, int) /home/smarchi/src/binutils-gdb/gdb/top.c:692
>     #17 0x564a4f67dc89 in command_handler(char const*) /home/smarchi/src/binutils-gdb/gdb/event-top.c:616
>     #18 0x564a50c8c1d6 in read_command_file(_IO_FILE*) /home/smarchi/src/binutils-gdb/gdb/top.c:461
>     #19 0x564a4ed1ea61 in script_from_file(_IO_FILE*, char const*) /home/smarchi/src/binutils-gdb/gdb/cli/cli-script.c:1638
>     #20 0x564a4ec4cff3 in source_script_from_stream /home/smarchi/src/binutils-gdb/gdb/cli/cli-cmds.c:728
>     #21 0x564a4ec4d43b in source_script_with_search /home/smarchi/src/binutils-gdb/gdb/cli/cli-cmds.c:773
>     #22 0x564a4ec4da65 in source_command /home/smarchi/src/binutils-gdb/gdb/cli/cli-cmds.c:831
> 
> It then crashes when trying to look up again the command, for the
> post-hook, as the pointer to the command text (pointing to the string
> that used to be owned by the static buffer) is now stale:
> 
>     #0 0x564a4ec92209 in lookup_cmd_1(char const**, cmd_list_element*, cmd_list_element**, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >*, int, bool) /home/smarchi/src/binutils-gdb/gdb/cli/cli-decode.c:1990
>     #1 0x564a4ec9338e in lookup_cmd(char const**, cmd_list_element*, char const*, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >*, int, int) /home/smarchi/src/binutils-gdb/gdb/cli/cli-decode.c:2147
>     #2 0x564a50c8e3b2 in execute_command(char const*, int) /home/smarchi/src/binutils-gdb/gdb/top.c:701
>     #3 0x564a4f67dc89 in command_handler(char const*) /home/smarchi/src/binutils-gdb/gdb/event-top.c:616
>     #4 0x564a50c8c1d6 in read_command_file(_IO_FILE*) /home/smarchi/src/binutils-gdb/gdb/top.c:461
>     #5 0x564a4ed1ea61 in script_from_file(_IO_FILE*, char const*) /home/smarchi/src/binutils-gdb/gdb/cli/cli-script.c:1638
>     #6 0x564a4ec4cff3 in source_script_from_stream /home/smarchi/src/binutils-gdb/gdb/cli/cli-cmds.c:728
>     #7 0x564a4ec4d43b in source_script_with_search /home/smarchi/src/binutils-gdb/gdb/cli/cli-cmds.c:773
>     #8 0x564a4ec4da65 in source_command /home/smarchi/src/binutils-gdb/gdb/cli/cli-cmds.c:831
> 
> From the point of view of execute_command, its `p` argument unexpectedly
> becomes stale after calling cmd_func.  A quick fix would be to make
> execute_command duplicate `p` on entry and use that.  However, I think
> the right fix would be to get rid of the static buffer, have
> command_line_input return an allocated buffer / string.  Otherwise, it's
> just adding complexity to an area that is difficult to understand fully.
> 
> Simon

Just FYI and to avoid duplicate work, I have a patch that looks
promising, that removes the static buffer and uses std::string
throughout these functions (making managing memory easier than with
struct buffer):

https://review.lttng.org/c/binutils-gdb/+/9175

I'm currently waiting for my CI task to run, and I will also need to
write the commit message (tomorrow).

Simon