From: Simon Marchi <simark@simark.ca>
To: Tom Tromey <tom@tromey.com>,
Simon Marchi via Gdb-patches <gdb-patches@sourceware.org>
Cc: Jan Vrany <jan.vrany@labware.com>, luis.machado@arm.com
Subject: Re: [PATCH] gdb: fix command lookup in execute_command () commands"
Date: Wed, 14 Dec 2022 13:30:19 -0500 [thread overview]
Message-ID: <becb8438-81ef-8ad8-cc42-fcbfaea8cddd@simark.ca> (raw)
In-Reply-To: <87v8mddfne.fsf@tromey.com>
On 12/14/22 13:05, Tom Tromey wrote:
> Simon> Do you have ASan enabled in that build?
>
> Nope, but I tried it and I was able to reproduce the problem.
> I should have thought of that earlier :{
>
> Tom
I think the problem is the static buffer used in command_line_input.
The "define set xxx_yyy" command is read into the static buffer here:
#5 0x564a50c93555 in command_line_input(char const*, char const*) /home/smarchi/src/binutils-gdb/gdb/top.c:1421
#6 0x564a50c8c1b2 in read_command_file(_IO_FILE*) /home/smarchi/src/binutils-gdb/gdb/top.c:458
#7 0x564a4ed1ea61 in script_from_file(_IO_FILE*, char const*) /home/smarchi/src/binutils-gdb/gdb/cli/cli-script.c:1638
#8 0x564a4ec4cff3 in source_script_from_stream /home/smarchi/src/binutils-gdb/gdb/cli/cli-cmds.c:728
#9 0x564a4ec4d43b in source_script_with_search /home/smarchi/src/binutils-gdb/gdb/cli/cli-cmds.c:773
#10 0x564a4ec4da65 in source_command /home/smarchi/src/binutils-gdb/gdb/cli/cli-cmds.c:831
That same buffer is used for reading the lines inside the define, here:
#5 0x564a50c93555 in command_line_input(char const*, char const*) /home/smarchi/src/binutils-gdb/gdb/top.c:1421
#6 0x564a4ed0cc32 in read_next_line /home/smarchi/src/binutils-gdb/gdb/cli/cli-script.c:920
#7 0x564a4ed286f6 in gdb::function_view<char const* ()>::bind<char const*>(char const* (*)())::{lambda(gdb::fv_detail::erased_callable)#1}::operator()(gdb::fv_detail::erased_callable) const /home/smarchi/src/binutils-gdb/gdb/../gdbsupport/function-view.h:326
#8 0x564a4ed28772 in gdb::function_view<char const* ()>::bind<char const*>(char const* (*)())::{lambda(gdb::fv_detail::erased_callable)#1}::_FUN(gdb::fv_detail::erased_callable) /home/smarchi/src/binutils-gdb/gdb/../gdbsupport/function-view.h:320
#9 0x564a4ed25288 in gdb::function_view<char const* ()>::operator()() const /home/smarchi/src/binutils-gdb/gdb/../gdbsupport/function-view.h:289
#10 0x564a4ed1adf2 in read_command_lines_1(gdb::function_view<char const* ()>, int, gdb::function_view<void (char const*)>) /home/smarchi/src/binutils-gdb/gdb/cli/cli-script.c:1234
#11 0x564a4ed1a997 in read_command_lines(char const*, int, int, gdb::function_view<void (char const*)>) /home/smarchi/src/binutils-gdb/gdb/cli/cli-script.c:1202
#12 0x564a4ed1c8e6 in do_define_command /home/smarchi/src/binutils-gdb/gdb/cli/cli-script.c:1450
#13 0x564a4ed1d2bc in define_command /home/smarchi/src/binutils-gdb/gdb/cli/cli-script.c:1500
#14 0x564a4ec82cbc in do_simple_func /home/smarchi/src/binutils-gdb/gdb/cli/cli-decode.c:95
#15 0x564a4ec99059 in cmd_func(cmd_list_element*, char const*, int) /home/smarchi/src/binutils-gdb/gdb/cli/cli-decode.c:2543
#16 0x564a50c8e30d in execute_command(char const*, int) /home/smarchi/src/binutils-gdb/gdb/top.c:692
#17 0x564a4f67dc89 in command_handler(char const*) /home/smarchi/src/binutils-gdb/gdb/event-top.c:616
#18 0x564a50c8c1d6 in read_command_file(_IO_FILE*) /home/smarchi/src/binutils-gdb/gdb/top.c:461
#19 0x564a4ed1ea61 in script_from_file(_IO_FILE*, char const*) /home/smarchi/src/binutils-gdb/gdb/cli/cli-script.c:1638
#20 0x564a4ec4cff3 in source_script_from_stream /home/smarchi/src/binutils-gdb/gdb/cli/cli-cmds.c:728
#21 0x564a4ec4d43b in source_script_with_search /home/smarchi/src/binutils-gdb/gdb/cli/cli-cmds.c:773
#22 0x564a4ec4da65 in source_command /home/smarchi/src/binutils-gdb/gdb/cli/cli-cmds.c:831
It then crashes when trying to look up again the command, for the
post-hook, as the pointer to the command text (pointing to the string
that used to be owned by the static buffer) is now stale:
#0 0x564a4ec92209 in lookup_cmd_1(char const**, cmd_list_element*, cmd_list_element**, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >*, int, bool) /home/smarchi/src/binutils-gdb/gdb/cli/cli-decode.c:1990
#1 0x564a4ec9338e in lookup_cmd(char const**, cmd_list_element*, char const*, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >*, int, int) /home/smarchi/src/binutils-gdb/gdb/cli/cli-decode.c:2147
#2 0x564a50c8e3b2 in execute_command(char const*, int) /home/smarchi/src/binutils-gdb/gdb/top.c:701
#3 0x564a4f67dc89 in command_handler(char const*) /home/smarchi/src/binutils-gdb/gdb/event-top.c:616
#4 0x564a50c8c1d6 in read_command_file(_IO_FILE*) /home/smarchi/src/binutils-gdb/gdb/top.c:461
#5 0x564a4ed1ea61 in script_from_file(_IO_FILE*, char const*) /home/smarchi/src/binutils-gdb/gdb/cli/cli-script.c:1638
#6 0x564a4ec4cff3 in source_script_from_stream /home/smarchi/src/binutils-gdb/gdb/cli/cli-cmds.c:728
#7 0x564a4ec4d43b in source_script_with_search /home/smarchi/src/binutils-gdb/gdb/cli/cli-cmds.c:773
#8 0x564a4ec4da65 in source_command /home/smarchi/src/binutils-gdb/gdb/cli/cli-cmds.c:831
From the point of view of execute_command, its `p` argument unexpectedly
becomes stale after calling cmd_func. A quick fix would be to make
execute_command duplicate `p` on entry and use that. However, I think
the right fix would be to get rid of the static buffer, have
command_line_input return an allocated buffer / string. Otherwise, it's
just adding complexity to an area that is difficult to understand fully.
Simon
next prev parent reply other threads:[~2022-12-14 18:30 UTC|newest]
Thread overview: 31+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-12-08 14:20 [PATCH] gdb: fix possible use-after-free when executing commands Jan Vrany
2022-12-09 17:55 ` Tom Tromey
2022-12-12 15:05 ` Luis Machado
2022-12-12 15:08 ` Jan Vraný
2022-12-12 15:09 ` Luis Machado
2022-12-13 11:22 ` [PATCH] gdb: fix command lookup in execute_command () Jan Vrany
2022-12-13 15:05 ` Tom Tromey
2022-12-13 16:43 ` Simon Marchi
2022-12-13 18:48 ` Jan Vraný
2022-12-13 19:29 ` Simon Marchi
2022-12-14 11:07 ` [PATCH] gdb: fix command lookup in execute_command () commands" Jan Vrany
2022-12-14 15:35 ` Simon Marchi
2022-12-14 15:41 ` Jan Vraný
2022-12-14 15:59 ` Tom Tromey
2022-12-14 16:01 ` Simon Marchi
2022-12-14 18:05 ` Tom Tromey
2022-12-14 18:30 ` Simon Marchi [this message]
2022-12-14 22:01 ` Simon Marchi
2022-12-16 14:07 ` [PATCH] gdb: fix command lookup in execute_command () Jan Vraný
2022-12-16 16:47 ` Simon Marchi
2022-12-19 11:48 ` Jan Vraný
2022-12-19 14:46 ` Tom Tromey
2022-12-19 15:51 ` Jan Vraný
2022-12-20 19:10 ` Tom Tromey
2022-12-14 19:52 ` [PATCH] gdb: fix possible use-after-free when executing commands Simon Marchi
2022-12-14 20:39 ` Jan Vraný
2022-12-14 20:42 ` Simon Marchi
2022-12-15 12:57 ` Jan Vrany
2022-12-15 13:53 ` Simon Marchi
2022-12-15 14:51 ` Jan Vrany
2022-12-15 16:00 ` Simon Marchi
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=becb8438-81ef-8ad8-cc42-fcbfaea8cddd@simark.ca \
--to=simark@simark.ca \
--cc=gdb-patches@sourceware.org \
--cc=jan.vrany@labware.com \
--cc=luis.machado@arm.com \
--cc=tom@tromey.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).