remote/2154: cached buffer pointers not updated after executing new getpkt

remote/2154: cached buffer pointers not updated after executing new getpkt

[strauman]

>Number:         2154
>Category:       remote
>Synopsis:       cached buffer pointers not updated after executing new getpkt
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    unassigned
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Aug 10 02:58:01 GMT 2006
>Closed-Date:
>Last-Modified:
>Originator:     Till Straumann
>Release:        6.5
>Organization:
>Environment:

>Description:
At many places in remote.c the buffer pointer is cached

char *buf = rs->buf;

but not updated after executing getpkt(&rs->buf,...).
If rs->buf is ever reallocated then the cached pointer
is invalid.
>How-To-Repeat:

>Fix:
attached. I did this quickly, someone should review...
>Release-Note:
>Audit-Trail:
>Unformatted:
----gnatsweb-attachment----
Content-Type: text/x-patch; name="remote.c-update-cached-bufptrs.diff"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="remote.c-update-cached-bufptrs.diff"

KioqIHJlbW90ZS5jLm9yaWcJMjAwNi0wNS0wNSAxMzowODo0NS4wMDAwMDAwMDAgLTA3MDAKLS0t
IHJlbW90ZS5jCTIwMDYtMDgtMDkgMTk6NTE6MTcuMDAwMDAwMDAwIC0wNzAwCioqKioqKioqKioq
KioqKgoqKiogOTI3LDkzMiAqKioqCi0tLSA5MjcsOTMzIC0tLS0KICAgICAgeHNucHJpbnRmICgm
YnVmWzJdLCBycy0+cmVtb3RlX3BhY2tldF9zaXplIC0gMiwgIiV4IiwgdGgpOwogICAgcHV0cGt0
IChidWYpOwogICAgZ2V0cGt0ICgmcnMtPmJ1ZiwgJnJzLT5idWZfc2l6ZSwgMCk7CisgICBidWYg
PSBycy0+YnVmOwogICAgaWYgKGdlbikKICAgICAgZ2VuZXJhbF90aHJlYWQgPSB0aDsKICAgIGVs
c2UKKioqKioqKioqKioqKioqCioqKiA5NDgsOTUzICoqKioKLS0tIDk0OSw5NTUgLS0tLQogICAg
ICB4c25wcmludGYgKGJ1ZiwgcnMtPnJlbW90ZV9wYWNrZXRfc2l6ZSwgIlQlMDh4IiwgdGlkKTsK
ICAgIHB1dHBrdCAoYnVmKTsKICAgIGdldHBrdCAoJnJzLT5idWYsICZycy0+YnVmX3NpemUsIDAp
OworICAgYnVmID0gcnMtPmJ1ZjsKICAgIHJldHVybiAoYnVmWzBdID09ICdPJyAmJiBidWZbMV0g
PT0gJ0snKTsKICB9CiAgCioqKioqKioqKioqKioqKgoqKiogMTQ1MiwxNDU3ICoqKioKLS0tIDE0
NTQsMTQ2MCAtLS0tCiAgICBwYWNrX3RocmVhZGluZm9fcmVxdWVzdCAodGhyZWFkaW5mb19wa3Qs
IGZpZWxkc2V0LCB0aHJlYWRpZCk7CiAgICBwdXRwa3QgKHRocmVhZGluZm9fcGt0KTsKICAgIGdl
dHBrdCAoJnJzLT5idWYsICZycy0+YnVmX3NpemUsIDApOworICAgdGhyZWFkaW5mb19wa3QgPSBy
cy0+YnVmOwogICAgcmVzdWx0ID0gcmVtb3RlX3VucGFja190aHJlYWRfaW5mb19yZXNwb25zZSAo
dGhyZWFkaW5mb19wa3QgKyAyLAogIAkJCQkJICAgICAgIHRocmVhZGlkLCBpbmZvKTsKICAgIHJl
dHVybiByZXN1bHQ7CioqKioqKioqKioqKioqKgoqKiogMTUxOCwxNTIzICoqKioKLS0tIDE1MjEs
MTUyNyAtLS0tCiAgICBwYWNrX3RocmVhZGxpc3RfcmVxdWVzdCAocnMtPmJ1Ziwgc3RhcnRmbGFn
LCByZXN1bHRfbGltaXQsIG5leHR0aHJlYWQpOwogICAgcHV0cGt0IChycy0+YnVmKTsKICAgIGdl
dHBrdCAoJnJzLT5idWYsICZycy0+YnVmX3NpemUsIDApOworICAgdGhyZWFkbGlzdF9wYWNrZXQg
PSBycy0+YnVmOwogIAogICAgKnJlc3VsdF9jb3VudCA9CiAgICAgIHBhcnNlX3RocmVhZGxpc3Rf
cmVzcG9uc2UgKHJzLT5idWYgKyAyLCByZXN1bHRfbGltaXQsICZlY2hvX25leHR0aHJlYWQsCioq
KioqKioqKioqKioqKgoqKiogMTYyOSwxNjM0ICoqKioKLS0tIDE2MzMsMTYzOSAtLS0tCiAgCiAg
ICBwdXRwa3QgKCJxQyIpOwogICAgZ2V0cGt0ICgmcnMtPmJ1ZiwgJnJzLT5idWZfc2l6ZSwgMCk7
CisgICBidWYgPSBycy0+YnVmOwogICAgaWYgKGJ1ZlswXSA9PSAnUScgJiYgYnVmWzFdID09ICdD
JykKICAgICAgLyogVXNlIHN0cnRvdWwgaGVyZSwgc28gd2UnbGwgY29ycmVjdGx5IHBhcnNlIHZh
bHVlcyB3aG9zZSBoaWdoZXN0CiAgICAgICAgIGJpdCBpcyBzZXQuICBUaGUgcHJvdG9jb2wgY2Fy
cmllcyB0aGVtIGFzIGEgc2ltcGxlIHNlcmllcyBvZgoqKioqKioqKioqKioqKioKKioqIDE2NzMs
MTY4MCAqKioqCiAgICBpZiAodXNlX3RocmVhZGluZm9fcXVlcnkpCiAgICAgIHsKICAgICAgICBw
dXRwa3QgKCJxZlRocmVhZEluZm8iKTsKLSAgICAgICBidWZwID0gcnMtPmJ1ZjsKICAgICAgICBn
ZXRwa3QgKCZycy0+YnVmLCAmcnMtPmJ1Zl9zaXplLCAwKTsKICAgICAgICBpZiAoYnVmcFswXSAh
PSAnXDAnKQkJLyogcSBwYWNrZXQgcmVjb2duaXplZCAqLwogIAl7CiAgCSAgd2hpbGUgKCpidWZw
KysgPT0gJ20nKQkvKiByZXBseSBjb250YWlucyBvbmUgb3IgbW9yZSBUSUQgKi8KLS0tIDE2Nzgs
MTY4NSAtLS0tCiAgICBpZiAodXNlX3RocmVhZGluZm9fcXVlcnkpCiAgICAgIHsKICAgICAgICBw
dXRwa3QgKCJxZlRocmVhZEluZm8iKTsKICAgICAgICBnZXRwa3QgKCZycy0+YnVmLCAmcnMtPmJ1
Zl9zaXplLCAwKTsKKyAgICAgICBidWZwID0gcnMtPmJ1ZjsKICAgICAgICBpZiAoYnVmcFswXSAh
PSAnXDAnKQkJLyogcSBwYWNrZXQgcmVjb2duaXplZCAqLwogIAl7CiAgCSAgd2hpbGUgKCpidWZw
KysgPT0gJ20nKQkvKiByZXBseSBjb250YWlucyBvbmUgb3IgbW9yZSBUSUQgKi8KKioqKioqKioq
KioqKioqCioqKiAxNjkzLDE3MDAgKioqKgogIAkJfQogIAkgICAgICB3aGlsZSAoKmJ1ZnArKyA9
PSAnLCcpOwkvKiBjb21tYS1zZXBhcmF0ZWQgbGlzdCAqLwogIAkgICAgICBwdXRwa3QgKCJxc1Ro
cmVhZEluZm8iKTsKLSAJICAgICAgYnVmcCA9IHJzLT5idWY7CiAgCSAgICAgIGdldHBrdCAoJnJz
LT5idWYsICZycy0+YnVmX3NpemUsIDApOwogIAkgICAgfQogIAkgIHJldHVybjsJLyogZG9uZSAq
LwogIAl9Ci0tLSAxNjk4LDE3MDUgLS0tLQogIAkJfQogIAkgICAgICB3aGlsZSAoKmJ1ZnArKyA9
PSAnLCcpOwkvKiBjb21tYS1zZXBhcmF0ZWQgbGlzdCAqLwogIAkgICAgICBwdXRwa3QgKCJxc1Ro
cmVhZEluZm8iKTsKICAJICAgICAgZ2V0cGt0ICgmcnMtPmJ1ZiwgJnJzLT5idWZfc2l6ZSwgMCk7
CisgCSAgICAgIGJ1ZnAgPSBycy0+YnVmOwogIAkgICAgfQogIAkgIHJldHVybjsJLyogZG9uZSAq
LwogIAl9CioqKioqKioqKioqKioqKgoqKiogMTczOCwxNzQzICoqKioKLS0tIDE3NDMsMTc0OSAt
LS0tCiAgCQkgUElER0VUICh0cC0+cHRpZCkpOwogICAgICAgIHB1dHBrdCAoYnVmcCk7CiAgICAg
ICAgZ2V0cGt0ICgmcnMtPmJ1ZiwgJnJzLT5idWZfc2l6ZSwgMCk7CisgICAgICAgYnVmcCA9IHJz
LT5idWY7CiAgICAgICAgaWYgKGJ1ZnBbMF0gIT0gMCkKICAJewogIAkgIG4gPSBtaW4gKHN0cmxl
biAoYnVmcCkgLyAyLCBzaXplb2YgKGRpc3BsYXlfYnVmKSk7CioqKioqKioqKioqKioqKgoqKiog
MTgxOSwxODI0ICoqKioKLS0tIDE4MjUsMTgzMSAtLS0tCiAgCiAgICBwdXRwa3QgKCJxT2Zmc2V0
cyIpOwogICAgZ2V0cGt0ICgmcnMtPmJ1ZiwgJnJzLT5idWZfc2l6ZSwgMCk7CisgICBidWYgPSBy
cy0+YnVmOwogIAogICAgaWYgKGJ1ZlswXSA9PSAnXDAwMCcpCiAgICAgIHJldHVybjsJCQkvKiBS
ZXR1cm4gc2lsZW50bHkuICBTdHViIGRvZXNuJ3Qgc3VwcG9ydAoqKioqKioqKioqKioqKioKKioq
IDE5ODEsMTk5MiAqKioqCiAgICAgICBiZWNhdXNlIHdlIG5lZWQgYm90aCBhdCB0aGUgc2FtZSB0
aW1lLiAgKi8KICAgIG1zZyA9IGFsbG9jYSAocnMtPnJlbW90ZV9wYWNrZXRfc2l6ZSk7CiAgCi0g
ICByZXBseSA9IHJzLT5idWY7Ci0gCiAgICAvKiBJbnZpdGUgdGFyZ2V0IHRvIHJlcXVlc3Qgc3lt
Ym9sIGxvb2t1cHMuICAqLwogIAogICAgcHV0cGt0ICgicVN5bWJvbDo6Iik7CiAgICBnZXRwa3Qg
KCZycy0+YnVmLCAmcnMtPmJ1Zl9zaXplLCAwKTsKICAgIHBhY2tldF9vayAocnMtPmJ1ZiwgJnJl
bW90ZV9wcm90b2NvbF9wYWNrZXRzW1BBQ0tFVF9xU3ltYm9sXSk7CiAgCiAgICB3aGlsZSAoc3Ry
bmNtcCAocmVwbHksICJxU3ltYm9sOiIsIDgpID09IDApCi0tLSAxOTg4LDE5OTggLS0tLQogICAg
ICAgYmVjYXVzZSB3ZSBuZWVkIGJvdGggYXQgdGhlIHNhbWUgdGltZS4gICovCiAgICBtc2cgPSBh
bGxvY2EgKHJzLT5yZW1vdGVfcGFja2V0X3NpemUpOwogIAogICAgLyogSW52aXRlIHRhcmdldCB0
byByZXF1ZXN0IHN5bWJvbCBsb29rdXBzLiAgKi8KICAKICAgIHB1dHBrdCAoInFTeW1ib2w6OiIp
OwogICAgZ2V0cGt0ICgmcnMtPmJ1ZiwgJnJzLT5idWZfc2l6ZSwgMCk7CisgICByZXBseSA9IHJz
LT5idWY7CiAgICBwYWNrZXRfb2sgKHJzLT5idWYsICZyZW1vdGVfcHJvdG9jb2xfcGFja2V0c1tQ
QUNLRVRfcVN5bWJvbF0pOwogIAogICAgd2hpbGUgKHN0cm5jbXAgKHJlcGx5LCAicVN5bWJvbDoi
LCA4KSA9PSAwKQoqKioqKioqKioqKioqKioKKioqIDIwMDMsMjAwOCAqKioqCi0tLSAyMDA5LDIw
MTUgLS0tLQogIAkJICAgJnJlcGx5WzhdKTsKICAgICAgICBwdXRwa3QgKG1zZyk7CiAgICAgICAg
Z2V0cGt0ICgmcnMtPmJ1ZiwgJnJzLT5idWZfc2l6ZSwgMCk7CisgICAgICAgcmVwbHkgPSBycy0+
YnVmOwogICAgICB9CiAgfQogIAoqKioqKioqKioqKioqKioKKioqIDIyNzQsMjI3OSAqKioqCi0t
LSAyMjgxLDIyODcgLS0tLQogICAgc3RyY3B5IChidWYsICJ2Q29udD8iKTsKICAgIHB1dHBrdCAo
YnVmKTsKICAgIGdldHBrdCAoJnJzLT5idWYsICZycy0+YnVmX3NpemUsIDApOworICAgYnVmID0g
cnMtPmJ1ZjsKICAKICAgIC8qIE1ha2Ugc3VyZSB0aGF0IHRoZSBmZWF0dXJlcyB3ZSBhc3N1bWUg
YXJlIHN1cHBvcnRlZC4gICovCiAgICBpZiAoc3RybmNtcCAoYnVmLCAidkNvbnQiLCA1KSA9PSAw
KQoqKioqKioqKioqKioqKioKKioqIDI2ODEsMjY4NiAqKioqCi0tLSAyNjg5LDI2OTUgLS0tLQog
IAogICAgICAgIG9mdW5jID0gc2lnbmFsIChTSUdJTlQsIHJlbW90ZV9pbnRlcnJ1cHQpOwogICAg
ICAgIGdldHBrdCAoJnJzLT5idWYsICZycy0+YnVmX3NpemUsIDEpOworICAgICAgIGJ1ZiA9IHJz
LT5idWY7CiAgICAgICAgc2lnbmFsIChTSUdJTlQsIG9mdW5jKTsKICAKICAgICAgICAvKiBUaGlz
IGlzIGEgaG9vayBmb3Igd2hlbiB3ZSBuZWVkIHRvIGRvIHNvbWV0aGluZyAocGVyaGFwcyB0aGUK
KioqKioqKioqKioqKioqCioqKiAyODc3LDI4ODIgKioqKgotLS0gMjg4NiwyODkyIC0tLS0KICAg
ICAgICAgICBIb3dldmVyLCBiZWZvcmUgd2UgZG8gdGhhdCB3ZSBuZWVkIHRvIGVuc3VyZSB0aGF0
IHRoZSBjYWxsZXIKICAgICAgICAgICBrbm93cyBob3cgdG8gdGFrZSB0aGUgdGFyZ2V0IGludG8v
b3V0IG9mIGFzeW5jIG1vZGUuICAqLwogICAgICAgIGdldHBrdCAoJnJzLT5idWYsICZycy0+YnVm
X3NpemUsIHdhaXRfZm9yZXZlcl9lbmFibGVkX3ApOworICAgICAgIGJ1ZiA9IHJzLT5idWY7CiAg
ICAgICAgaWYgKCF0YXJnZXRfaXNfYXN5bmNfcCAoKSkKICAJc2lnbmFsIChTSUdJTlQsIG9mdW5j
KTsKICAKKioqKioqKioqKioqKioqCioqKiAzMTcxLDMxNzYgKioqKgotLS0gMzE4MSwzMTg3IC0t
LS0KICAJZnByaW50Zl91bmZpbHRlcmVkIChnZGJfc3RkbG9nLAogIAkJCSAgICAiQmFkIHJlZ2lz
dGVyIHBhY2tldDsgZmV0Y2hpbmcgYSBuZXcgcGFja2V0XG4iKTsKICAgICAgICBnZXRwa3QgKCZy
cy0+YnVmLCAmcnMtPmJ1Zl9zaXplLCAwKTsKKyAgICAgICBidWYgPSBycy0+YnVmOwogICAgICB9
CiAgCiAgICAvKiBSZXBseSBkZXNjcmliZXMgcmVnaXN0ZXJzIGJ5dGUgYnkgYnl0ZSwgZWFjaCBi
eXRlIGVuY29kZWQgYXMgdHdvCioqKioqKioqKioqKioqKgoqKiogMzQ0MywzNDQ4ICoqKioKLS0t
IDM0NTQsMzQ2MCAtLS0tCiAgCiAgCXB1dHBrdF9iaW5hcnkgKGJ1ZiwgKGludCkgKHAgLSBidWYp
KTsKICAJZ2V0cGt0ICgmcnMtPmJ1ZiwgJnJzLT5idWZfc2l6ZSwgMCk7CisgCWJ1ZiA9IHJzLT5i
dWY7CiAgCiAgCWlmIChidWZbMF0gPT0gJ1wwJykKICAJICB7CioqKioqKioqKioqKioqKgoqKiog
MzYwMCwzNjA1ICoqKioKLS0tIDM2MTIsMzYxOCAtLS0tCiAgCiAgICBwdXRwa3RfYmluYXJ5IChi
dWYsIChpbnQpIChwIC0gYnVmKSk7CiAgICBnZXRwa3QgKCZycy0+YnVmLCAmcnMtPmJ1Zl9zaXpl
LCAwKTsKKyAgIGJ1ZiA9IHJzLT5idWY7CiAgCiAgICBpZiAoYnVmWzBdID09ICdFJykKICAgICAg
ewoqKioqKioqKioqKioqKioKKioqIDM2NjUsMzY3MCAqKioqCi0tLSAzNjc4LDM2ODQgLS0tLQog
IAogICAgICAgIHB1dHBrdCAoYnVmKTsKICAgICAgICBnZXRwa3QgKCZycy0+YnVmLCAmcnMtPmJ1
Zl9zaXplLCAwKTsKKyAgICAgICBidWYgPSBycy0+YnVmOwogIAogICAgICAgIGlmIChidWZbMF0g
PT0gJ0UnCiAgCSAgJiYgaXN4ZGlnaXQgKGJ1ZlsxXSkgJiYgaXN4ZGlnaXQgKGJ1ZlsyXSkKKioq
KioqKioqKioqKioqCioqKiA0OTcxLDQ5NzYgKioqKgotLS0gNDk4NSw0OTkxIC0tLS0KICAgICAg
ICAvKiBYWFggLSBzZWUgYWxzbyB0cmFjZXBvaW50LmM6cmVtb3RlX2dldF9ub2lzeV9yZXBseSgp
LiAgKi8KICAgICAgICBidWZbMF0gPSAnXDAnOwogICAgICAgIGdldHBrdCAoJnJzLT5idWYsICZy
cy0+YnVmX3NpemUsIDApOworICAgICAgIGJ1ZiA9IHJzLT5idWY7CiAgICAgICAgaWYgKGJ1Zlsw
XSA9PSAnXDAnKQogIAllcnJvciAoXygiVGFyZ2V0IGRvZXMgbm90IHN1cHBvcnQgdGhpcyBjb21t
YW5kLiIpKTsKICAgICAgICBpZiAoYnVmWzBdID09ICdPJyAmJiBidWZbMV0gIT0gJ0snKQo=

Re: remote/2154: cached buffer pointers not updated after executing new getpkt

[drow]

Synopsis: cached buffer pointers not updated after executing new getpkt

Responsible-Changed-From-To: unassigned->drow
Responsible-Changed-By: drow
Responsible-Changed-When: Wed Sep 20 19:17:14 2006
Responsible-Changed-Why:
    I've got this.
State-Changed-From-To: open->closed
State-Changed-By: drow
State-Changed-When: Wed Sep 20 19:17:14 2006
State-Changed-Why:
    I checked in a similar, but slightly more thorough, fix.  Thanks for the report!

http://sourceware.org/cgi-bin/gnatsweb.pl?cmd=view%20audit-trail&database=gdb&pr=2154

Re: remote/2154: cached buffer pointers not updated after executing new getpkt

[Daniel Jacobowitz]

The following reply was made to PR remote/2154; it has been noted by GNATS.

From: Daniel Jacobowitz <drow@false.org>
To: strauman@slac.stanford.edu
Cc: gdb-gnats@sources.redhat.com
Subject: Re: remote/2154: cached buffer pointers not updated after executing new getpkt
Date: Wed, 9 Aug 2006 23:11:50 -0400

 On Thu, Aug 10, 2006 at 02:54:17AM -0000, strauman@slac.stanford.edu wrote:
 > At many places in remote.c the buffer pointer is cached
 > 
 > char *buf = rs->buf;
 > 
 > but not updated after executing getpkt(&rs->buf,...).
 > If rs->buf is ever reallocated then the cached pointer
 > is invalid.
 
 Thanks!  I don't have time to look at the patch right now,
 but from your description, this is definitely something I didn't
 think of (and really the char *buf variables were just to reduce
 the size of the patch introducing rs->buf; probably time for them to go
 away now).
 
 -- 
 Daniel Jacobowitz
 CodeSourcery