This is the mail archive of the gdb-cvs@sourceware.org mailing list for the GDB project.


Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]
Other format: [Raw text]

[binutils-gdb] Fix memory corruption in Guile command interface


https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=84a4591a7ba0c83c165cde85898086e9a4019b0d

commit 84a4591a7ba0c83c165cde85898086e9a4019b0d
Author: Andy Wingo <wingo@igalia.com>
Date:   Wed Mar 11 14:25:29 2015 +0100

    Fix memory corruption in Guile command interface
    
    Re-registering a command will delete previous commands of the same name,
    running the destroyer for the command object.  The Guile destroyer
    incorrectly tried to xfree the name and other strings, which is invalid
    as they are on the GC heap.
    
    gdb/ChangeLog:
    
    	* guile/scm-cmd.c (cmdscm_destroyer): Don't xfree the name and
    	other strings, as these are on the GC'd heap, and will be
    	collected along with the smob.

Diff:
---
 gdb/ChangeLog       | 6 ++++++
 gdb/guile/scm-cmd.c | 5 -----
 2 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/gdb/ChangeLog b/gdb/ChangeLog
index 38d3005..4066a79 100644
--- a/gdb/ChangeLog
+++ b/gdb/ChangeLog
@@ -1,5 +1,11 @@
 2015-03-11  Andy Wingo  <wingo@igalia.com>
 
+	* guile/scm-cmd.c (cmdscm_destroyer): Don't xfree the name and
+	other strings, as these are on the GC'd heap, and will be
+	collected along with the smob.
+
+2015-03-11  Andy Wingo  <wingo@igalia.com>
+
 	* guile/scm-objfile.c (gdbscm_objfile_progspace): New function.
 	(objfile_functions): Bind gdbscm_objfile_progspace to
 	objfile-progspace.
diff --git a/gdb/guile/scm-cmd.c b/gdb/guile/scm-cmd.c
index c870fcc..202721b 100644
--- a/gdb/guile/scm-cmd.c
+++ b/gdb/guile/scm-cmd.c
@@ -286,11 +286,6 @@ cmdscm_destroyer (struct cmd_list_element *self, void *context)
   command_smob *c_smob = (command_smob *) context;
 
   cmdscm_release_command (c_smob);
-
-  /* We allocated the name, doc string, and perhaps the prefix name.  */
-  xfree ((char *) self->name);
-  xfree ((char *) self->doc);
-  xfree ((char *) self->prefixname);
 }
 
 /* Called by gdb to invoke the command.  */


Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]