[Bug cli/29096] AddressSanitizer: heap-use-after-free in execute_command

["vries at gcc dot gnu.org" <sourceware-bugzilla@sourceware.org>]

https://sourceware.org/bugzilla/show_bug.cgi?id=29096

Tom de Vries <vries at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |13.1
                 CC|                            |vries at gcc dot gnu.org
             Status|UNCONFIRMED                 |RESOLVED
         Resolution|---                         |FIXED

--- Comment #1 from Tom de Vries <vries at gcc dot gnu.org> ---
This seems to have been fixed by this (
https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=b5661ff24f7111246b9e9b5f1cba5afe9d479daf
) commit:
...
gdb: fix possible use-after-free when executing commands

In principle, `execute_command()` does following:

   struct cmd_list_element *c;
   c = lookup_cmd ( ... );
   ...
   /* If this command has been pre-hooked, run the hook first.  */
   execute_cmd_pre_hook (c);
   ...
   /* ...execute the command `c` ...*/
   ...
   execute_cmd_post_hook (c);

This may lead into use-after-free error.  Imagine the command
being executed is a user-defined Python command that redefines
itself.  In that case, struct `cmd_list_element` pointed to by
`c` is deallocated during its execution so it is no longer valid
when post hook is executed.

To fix this case, this commit looks up the command once again
after it is executed to get pointer to (possibly newly allocated)
`cmd_list_element`.
...

The patch was available in 13.1.

There are two patches fixing fall-out, one of them backported to 13.1, the
other one backported to 13.2.

AFAIU, the correct milestone for this is 13.1.

FWIW, IWBN to also have a test-case for this.

-- 
You are receiving this mail because:
You are on the CC list for the bug.