[binutils-gdb] compile: Fix ASAN crash for gdb.compile/compile.exp

[Jan Kratochvil <jkratoch at sourceware dot org>]

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=5fe75eec33c0f55536f09b2f3d692fb688a2c423

commit 5fe75eec33c0f55536f09b2f3d692fb688a2c423
Author: Jan Kratochvil <jan.kratochvil@redhat.com>
Date:   Tue May 19 16:12:30 2015 +0200

    compile: Fix ASAN crash for gdb.compile/compile.exp
    
    (gdb) PASS: gdb.compile/compile.exp: set unwindonsignal on
    compile code *(volatile int *) 0 = 0;
    Program received signal SIGSEGV, Segmentation fault.
    0x00007ffff7fba426 in _gdb_expr (__regs=0x7ffff7fb8000) at gdb command line:1
    1	gdb command line: No such file or directory.
    =================================================================
    ==10462==ERROR: AddressSanitizer: heap-use-after-free on address 0x621000cf7a3d at pc 0x0000004e46b9 bp 0x7ffdeb0f7a40 sp 0x7ffdeb0f71b8
    READ of size 10 at 0x621000cf7a3d thread T0
        #0 0x4e46b8 in printf_common(void*, char const*, __va_list_tag*) [clone .isra.6] (/home/jkratoch/redhat/gdb-clean-asan/gdb/gdb+0x4e46
    b8)
        #1 0x4f645e in vasprintf (/home/jkratoch/redhat/gdb-clean-asan/gdb/gdb+0x4f645e)
        #2 0xe5cf00 in xstrvprintf common/common-utils.c:120
        #3 0xe74192 in throw_it common/common-exceptions.c:332
        #4 0xe742f6 in throw_verror common/common-exceptions.c:361
        #5 0xddc89e in verror /home/jkratoch/redhat/gdb-clean-asan/gdb/utils.c:541
        #6 0xe734bd in error common/errors.c:43
        #7 0xafa1d6 in call_function_by_hand_dummy /home/jkratoch/redhat/gdb-clean-asan/gdb/infcall.c:1031
        #8 0xe81858 in compile_object_run compile/compile-object-run.c:119
        #9 0xe7733c in eval_compile_command compile/compile.c:577
        #10 0xe7541e in compile_code_command compile/compile.c:153
    
    It is obvious why that happens, dummy_frame_pop() will call compile objfile
    cleanup which will free that objfile and NAME then becomes a stale pointer.
    
    > Is there any reason we release OBJFILE in the dummy frame dtor?  Why
    > don't we register a cleanup to release in OBJFILE in compile_object_run?
    > together with releasing compile_module?  'struct compile_module' has a
    > field objfile, which should be released together with
    > 'struct compile_module' instead of dummy_frame.
    
    (gdb) break puts
    Breakpoint 2 at 0x3830c6fd30: file ioputs.c, line 34.
    (gdb) compile code puts("hello")
    Breakpoint 2, _IO_puts (str=0x7ffff7ff8000 "hello") at ioputs.c:34
    34      {
    The program being debugged stopped while in a function called from GDB.
    Evaluation of the expression containing the function
    (_gdb_expr) will be abandoned.
    When the function is done executing, GDB will silently stop.
    (gdb) bt
    (gdb) _
    
    Now compile_object_run() called from line
    	(gdb) compile code puts("hello")
    has finished for a long time.  But we still need to have that injected code
    OBJFILE valid when GDB is executing it.  Therefore OBJFILE is freed only from
    destructor of the frame #1.
    
    At the patched line of call_function_by_hand_dummy() the dummy frame
    destructor has not yet been run but it will be run before the fetched NAME
    will get used.
    
    gdb/ChangeLog
    2015-05-19  Jan Kratochvil  <jan.kratochvil@redhat.com>
    
    	Fix ASAN crash for gdb.compile/compile.exp.
    	* infcall.c (call_function_by_hand_dummy): Use xstrdup for NAME.

Diff:
---
 gdb/ChangeLog | 5 +++++
 gdb/infcall.c | 7 +++++--
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/gdb/ChangeLog b/gdb/ChangeLog
index 8fbc023..6d7a7cf 100644
--- a/gdb/ChangeLog
+++ b/gdb/ChangeLog
@@ -1,5 +1,10 @@
 2015-05-19  Jan Kratochvil  <jan.kratochvil@redhat.com>
 
+	Fix ASAN crash for gdb.compile/compile.exp.
+	* infcall.c (call_function_by_hand_dummy): Use xstrdup for NAME.
+
+2015-05-19  Jan Kratochvil  <jan.kratochvil@redhat.com>
+
 	* compile/compile-c-symbols.c (convert_symbol_sym, gcc_convert_symbol)
 	(gcc_symbol_address): Change gdb_stdout to gdb_stdlog.
 	* compile/compile-object-load.c (setup_sections, compile_object_load):
diff --git a/gdb/infcall.c b/gdb/infcall.c
index 5dd908d..f79afea 100644
--- a/gdb/infcall.c
+++ b/gdb/infcall.c
@@ -1104,8 +1104,11 @@ When the function is done executing, GDB will silently stop."),
 
   if (stopped_by_random_signal || stop_stack_dummy != STOP_STACK_DUMMY)
     {
-      const char *name = get_function_name (funaddr,
-					    name_buf, sizeof (name_buf));
+      /* Make a copy as NAME may be in an objfile freed by dummy_frame_pop.  */
+      char *name = xstrdup (get_function_name (funaddr,
+					       name_buf, sizeof (name_buf)));
+      make_cleanup (xfree, name);
+
 
       if (stopped_by_random_signal)
 	{