[PATCH v3 05/11] gdb, remote: fix crash when accessing removed events

[Mohamed Bouhaouel <mohamed.bouhaouel@intel.com>]

From: "Bouhaouel, Mohamed" <mohamed.bouhaouel@intel.com>

Dereferencing events after calling std::remove_if causes GDB to crash
because the matching unique_ptrs have been moved from and are null.
Fix by logging events in std::remove_if.

The bug is visible by inspection; reproducing it requires
discard_pending_stop_replies to be called with matching entries in the
queue and remote debug logging enabled.
---
 gdb/remote.c | 25 ++++++++++++++-----------
 1 file changed, 14 insertions(+), 11 deletions(-)

diff --git a/gdb/remote.c b/gdb/remote.c
index f6178caf7a1..323edd6cb0f 100644
--- a/gdb/remote.c
+++ b/gdb/remote.c
@@ -8254,17 +8254,20 @@ remote_target::discard_pending_stop_replies (struct inferior *inf)
 
   /* Discard the stop replies we have already pulled with
      vStopped.  */
-  auto iter = std::remove_if (rs->stop_reply_queue.begin (),
-			      rs->stop_reply_queue.end (),
-			      [=] (const stop_reply_up &event)
-			      {
-				return event->ptid.pid () == inf->pid;
-			      });
-  for (auto it = iter; it != rs->stop_reply_queue.end (); ++it)
-    remote_debug_printf
-      ("discarding queued stop reply: ptid: %s, ws: %s\n",
-       (*it)->ptid.to_string().c_str(),
-       (*it)->ws.to_string ().c_str ());
+  auto iter
+    = std::remove_if (rs->stop_reply_queue.begin (),
+		      rs->stop_reply_queue.end (),
+		      [=] (const stop_reply_up &event)
+		      {
+			if (event->ptid.pid () != inf->pid)
+			  return false;
+
+			remote_debug_printf
+			  ("discarding queued stop reply: ptid: %s, ws: %s\n",
+			   event->ptid.to_string ().c_str (),
+			   event->ws.to_string ().c_str ());
+			return true;
+		      });
   rs->stop_reply_queue.erase (iter, rs->stop_reply_queue.end ());
 }
 
-- 
2.43.0

Intel Deutschland GmbH

Registered Address: Dornacher Strasse 1, 85622 Feldkirchen, Germany
Tel: +49 89 991 430, www.intel.de
Managing Directors: Harry Demas, Jeffrey Schneiderman, Yin Chong Sorrell
Chairperson of the Supervisory Board: Nicole Lau
Registered Seat: Munich
Commercial Register: Amtsgericht Muenchen HRB 186928