[Bug gdb/23342] sanity check stale struct frame_info *

["tromey at sourceware dot org" <sourceware-bugzilla@sourceware.org>]

https://sourceware.org/bugzilla/show_bug.cgi?id=23342

--- Comment #8 from Tom Tromey <tromey at sourceware dot org> ---
(In reply to Jan Kratochvil from comment #6)
> (In reply to Tom Tromey from comment #5)
> > The more I consider the "automatic reinflating" idea, the more I like
> > it.  It would turn an assertion failure / crash into "what the code
> > should be doing anyway".
> 
> But then one will not find out the code is not handling invalidated frame
> pointers in a reasonable (non-crashing) way. Maybe it could be configurable
> by some --enable-maintainer-mode.

True, but my thinking here was that it doesn't matter.

The normal bug is that some code holds onto a frame_info* that is
the invalidated.  Then, it uses the pointer, resulting in a UAF.

The patch I have now turns the UAF into a crash, by turning the
dangling pointer into a NULL pointer.  Good so far.

The next step is that we would normally fix this kind of bug by
computing the frame_id and storing it, then using the frame_id to
look up the frame again.

The proposed "reinflation" approach is to automate this step.
It would just invisibly do what you were supposed to do anyway.

Is there ever a time when we wouldn't want to do this?
Or when it would cause some other bug?

-- 
You are receiving this mail because:
You are on the CC list for the bug.