Mirror of the gdb-patches mailing list
 help / color / mirror / Atom feed
From: Jan Vrany via Gdb-patches <gdb-patches@sourceware.org>
To: gdb-patches@sourceware.org
Cc: Jan Vrany <jan.vrany@labware.com>
Subject: [PATCH] gdb: fix possible use-after-free when executing commands
Date: Thu,  8 Dec 2022 14:20:14 +0000	[thread overview]
Message-ID: <20221208142014.84759-1-jan.vrany@labware.com> (raw)

In principle, `execute_command()` does following:

   struct cmd_list_element *c;
   c = lookup_cmd ( ... );
   ...
   /* If this command has been pre-hooked, run the hook first.  */
   execute_cmd_pre_hook (c);
   ...
   /* ...execute the command `c` ...*/
   ...
   execute_cmd_post_hook (c);

This may lead into use-after-free error.  Imagine the command
being executed is a user-defined Python command that redefines
itself.  In that case, struct `cmd_list_element` pointed to by
`c` is deallocated during its execution so it is no longer valid
when post hook is executed.

To fix this case, this commit looks up the command once again
after it is executed to get pointer to (possibly newly allocated)
`cmd_list_element`.
---
 gdb/top.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/gdb/top.c b/gdb/top.c
index e9794184f07..441ca3e14c1 100644
--- a/gdb/top.c
+++ b/gdb/top.c
@@ -655,6 +655,8 @@ execute_command (const char *p, int from_tty)
 	    }
 	}
 
+      std::string c_name(c->name);
+
       /* If this command has been pre-hooked, run the hook first.  */
       execute_cmd_pre_hook (c);
 
@@ -694,7 +696,9 @@ execute_command (const char *p, int from_tty)
       maybe_wait_sync_command_done (was_sync);
 
       /* If this command has been post-hooked, run the hook last.  */
-      execute_cmd_post_hook (c);
+      c = lookup_cmd_exact (c_name.c_str (), cmdlist);
+      if (c != nullptr)
+	execute_cmd_post_hook (c);
 
       if (repeat_arguments != NULL && cmd_start == saved_command_line)
 	{
-- 
2.35.1


             reply	other threads:[~2022-12-08 14:20 UTC|newest]

Thread overview: 31+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-12-08 14:20 Jan Vrany via Gdb-patches [this message]
2022-12-09 17:55 ` Tom Tromey
2022-12-12 15:05   ` Luis Machado via Gdb-patches
2022-12-12 15:08     ` Jan Vraný via Gdb-patches
2022-12-12 15:09     ` Luis Machado via Gdb-patches
2022-12-13 11:22     ` [PATCH] gdb: fix command lookup in execute_command () Jan Vrany via Gdb-patches
2022-12-13 15:05       ` Tom Tromey
2022-12-13 16:43         ` Simon Marchi via Gdb-patches
2022-12-13 18:48         ` Jan Vraný via Gdb-patches
2022-12-13 19:29           ` Simon Marchi via Gdb-patches
2022-12-14 11:07             ` [PATCH] gdb: fix command lookup in execute_command () commands" Jan Vrany via Gdb-patches
2022-12-14 15:35               ` Simon Marchi via Gdb-patches
2022-12-14 15:41                 ` Jan Vraný via Gdb-patches
2022-12-14 15:59               ` Tom Tromey
2022-12-14 16:01                 ` Simon Marchi via Gdb-patches
2022-12-14 18:05                   ` Tom Tromey
2022-12-14 18:30                     ` Simon Marchi via Gdb-patches
2022-12-14 22:01                       ` Simon Marchi via Gdb-patches
2022-12-16 14:07             ` [PATCH] gdb: fix command lookup in execute_command () Jan Vraný via Gdb-patches
2022-12-16 16:47               ` Simon Marchi via Gdb-patches
2022-12-19 11:48                 ` Jan Vraný via Gdb-patches
2022-12-19 14:46                   ` Tom Tromey
2022-12-19 15:51                     ` Jan Vraný via Gdb-patches
2022-12-20 19:10                       ` Tom Tromey
2022-12-14 19:52 ` [PATCH] gdb: fix possible use-after-free when executing commands Simon Marchi via Gdb-patches
2022-12-14 20:39   ` Jan Vraný via Gdb-patches
2022-12-14 20:42     ` Simon Marchi via Gdb-patches
2022-12-15 12:57       ` Jan Vrany via Gdb-patches
2022-12-15 13:53         ` Simon Marchi via Gdb-patches
2022-12-15 14:51           ` Jan Vrany via Gdb-patches
2022-12-15 16:00             ` Simon Marchi via Gdb-patches

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20221208142014.84759-1-jan.vrany@labware.com \
    --to=gdb-patches@sourceware.org \
    --cc=jan.vrany@labware.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox