Re: [PATCH] gdb: fix possible use-after-free when executing commands

["Jan Vraný via Gdb-patches" <gdb-patches@sourceware.org>]

On Wed, 2022-12-14 at 14:52 -0500, Simon Marchi wrote:
> 
> On 12/8/22 09:20, Jan Vrany via Gdb-patches wrote:
> > In principle, `execute_command()` does following:
> > 
> >    struct cmd_list_element *c;
> >    c = lookup_cmd ( ... );
> >    ...
> >    /* If this command has been pre-hooked, run the hook first.  */
> >    execute_cmd_pre_hook (c);
> >    ...
> >    /* ...execute the command `c` ...*/
> >    ...
> >    execute_cmd_post_hook (c);
> > 
> > This may lead into use-after-free error.  Imagine the command
> > being executed is a user-defined Python command that redefines
> > itself.  In that case, struct `cmd_list_element` pointed to by
> > `c` is deallocated during its execution so it is no longer valid
> > when post hook is executed.
> > 
> > To fix this case, this commit looks up the command once again
> > after it is executed to get pointer to (possibly newly allocated)
> > `cmd_list_element`.
> 
> Hi Jan,
> 
> Do you think you could write a test to exercise that fix?

Maybe, though I'm not quite sure how to make it fail unless
one uses ASAN or Valgrind to run it like you do. Will give it 
stab. 

Jan

> 
> Simon
>