From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <gdb-testers-return-56771-listarch-gdb-testers=sources.redhat.com@sourceware.org>
Received: (qmail 116753 invoked by alias); 3 May 2016 11:55:49 -0000
Mailing-List: contact gdb-testers-help@sourceware.org; run by ezmlm
Precedence: bulk
List-Id: <gdb-testers.sourceware.org>
List-Subscribe: <mailto:gdb-testers-subscribe@sourceware.org>
List-Archive: <http://sourceware.org/ml/gdb-testers/>
List-Post: <mailto:gdb-testers@sourceware.org>
List-Help: <mailto:gdb-testers-help@sourceware.org>, <http://sourceware.org/ml/#faqs>
Sender: gdb-testers-owner@sourceware.org
Received: (qmail 116736 invoked by uid 89); 3 May 2016 11:55:48 -0000
Authentication-Results: sourceware.org; auth=none
X-Virus-Found: No
X-Spam-SWARE-Status: No, score=-1.3 required=5.0 tests=AWL,BAYES_00,RP_MATCHES_RCVD,SPF_PASS autolearn=ham version=3.3.2 spammy=Hx-languages-length:2081
X-HELO: kwanyin.sergiodj.net
Received: from kwanyin.sergiodj.net (HELO kwanyin.sergiodj.net) (176.31.208.32) by sourceware.org (qpsmtpd/0.93/v0.84-503-g423c35a) with (AES128-SHA encrypted) ESMTPS; Tue, 03 May 2016 11:55:38 +0000
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Subject: [binutils-gdb/gdb-7.11-branch] Fix gdb/python/python.c use-after-free
From: sergiodj+buildbot@sergiodj.net
To: gdb-testers@sourceware.org
Message-Id: <329dec6fc5f2efa83d626583135081b53abe8729@gdb-build>
Date: Tue, 03 May 2016 11:55:00 -0000
X-SW-Source: 2016-q2/txt/msg02124.txt.bz2

*** TEST RESULTS FOR COMMIT 329dec6fc5f2efa83d626583135081b53abe8729 ***

Author: Pedro Alves <palves@redhat.com>
Branch: gdb-7.11-branch
Commit: 329dec6fc5f2efa83d626583135081b53abe8729

Fix gdb/python/python.c use-after-free

Valgrind shows:

 ==26964== Invalid read of size 1
 ==26964==    at 0x6E14100: __GI_strcmp (strcmp.S:180)
 ==26964==    by 0x6DB55AA: setlocale (setlocale.c:238)
 ==26964==    by 0x4E0455: _initialize_python() (python.c:1731)
 ==26964==    by 0x786731: initialize_all_files() (init.c:319)
 ==26964==    by 0x72EF0A: gdb_init(char*) (top.c:1929)
 ==26964==    by 0x60BCAC: captured_main(void*) (main.c:863)
 ==26964==    by 0x606AD5: catch_errors(int (*)(void*), void*, char*, return_mask) (exceptions.c:234)
 ==26964==    by 0x60C608: gdb_main(captured_main_args*) (main.c:1165)
 ==26964==    by 0x40CAEC: main (gdb.c:32)
 ==26964==  Address 0x81d30a0 is 0 bytes inside a block of size 181 free'd
 ==26964==    at 0x4C29CF0: free (vg_replace_malloc.c:530)
 ==26964==    by 0x6DB5B65: setname (setlocale.c:201)
 ==26964==    by 0x6DB5B65: setlocale (setlocale.c:388)
 ==26964==    by 0x4E037F: _initialize_python() (python.c:1712)
 ==26964==    by 0x786731: initialize_all_files() (init.c:319)
 ==26964==    by 0x72EF0A: gdb_init(char*) (top.c:1929)
 ==26964==    by 0x60BCAC: captured_main(void*) (main.c:863)
 ==26964==    by 0x606AD5: catch_errors(int (*)(void*), void*, char*, return_mask) (exceptions.c:234)
 ==26964==    by 0x60C608: gdb_main(captured_main_args*) (main.c:1165)
 ==26964==    by 0x40CAEC: main (gdb.c:32)

The problem is doing this:

  oldloc = setlocale (LC_ALL, NULL);
  setlocale (LC_ALL, "");
  ...
  setlocale (LC_ALL, oldloc);

I.e., the second setlocale call frees 'oldloc'.

>>From http://pubs.opengroup.org/onlinepubs/9699919799/functions/setlocale.html :

 "The returned string pointer might be invalidated or the string
 content might be overwritten by a subsequent call to setlocale()."

gdb/ChangeLog:
2016-05-03  Pedro Alves <palves@redhat.com>

	PR python/20037
	* python/python.c (_initialize_python) [IS_PY3K]: xstrdup/xfree
	oldloc.