FreeChainXenon/binutils-gdb
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

gdb: fix possible use-after-free when executing commands

Browse source 
In principle, `execute_command()` does following:

   struct cmd_list_element *c;
   c = lookup_cmd ( ... );
   ...
   /* If this command has been pre-hooked, run the hook first.  */
   execute_cmd_pre_hook (c);
   ...
   /* ...execute the command `c` ...*/
   ...
   execute_cmd_post_hook (c);

This may lead into use-after-free error.  Imagine the command
being executed is a user-defined Python command that redefines
itself.  In that case, struct `cmd_list_element` pointed to by
`c` is deallocated during its execution so it is no longer valid
when post hook is executed.

To fix this case, this commit looks up the command once again
after it is executed to get pointer to (possibly newly allocated)
`cmd_list_element`.
This commit is contained in:
Jan Vrany 2022-12-12 13:16:14 +00:00
parent a28fedbc3f
commit b5661ff24f
1 changed files with 12 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
gdb/top.c
View file

@ -655,6 +655,11 @@ execute_command (const char *p, int from_tty)
}
}
/* Remember name of the command. This is needed later when
executing command post-hooks to handle the case when command
is redefined or removed during it's execution. See below. */
std::string c_name (c->name);
/* If this command has been pre-hooked, run the hook first. */
execute_cmd_pre_hook (c);
@ -693,8 +698,13 @@ execute_command (const char *p, int from_tty)
maybe_wait_sync_command_done (was_sync);
/* If this command has been post-hooked, run the hook last. */
execute_cmd_post_hook (c);
/* If this command has been post-hooked, run the hook last.
We need to lookup the command again since during its execution,
a command may redefine itself. In this case, C pointer
becomes invalid so we need to look it up again. */
c = lookup_cmd_exact (c_name.c_str (), cmdlist);
if (c != nullptr)
execute_cmd_post_hook (c);
if (repeat_arguments != NULL && cmd_start == saved_command_line)
{