This is the mail archive of the
gdb-patches@sourceware.org
mailing list for the GDB project.
[patch] Fix completion memory double-free
- From: Jan Kratochvil <jan dot kratochvil at redhat dot com>
- To: gdb-patches at sourceware dot org
- Date: Sat, 20 Dec 2008 01:51:03 +0100
- Subject: [patch] Fix completion memory double-free
Hi,
p values[0].nonex.<tab>
causes a double-free (testcase included) when linked with `-lmcheck'.
Approval requested.
Regards,
Jan
gdb/
2008-12-20 Jan Kratochvil <jan.kratochvil@redhat.com>
Fix memory double-free.
* completer.c (line_completion_function): Clear LIST after called xfree.
gdb/testsuite/
2008-12-20 Jan Kratochvil <jan.kratochvil@redhat.com>
* gdb.base/completion.exp (Completing non-existing component): New test.
--- ./gdb/completer.c 24 Nov 2008 17:05:43 -0000 1.28
+++ ./gdb/completer.c 19 Dec 2008 23:59:36 -0000
@@ -752,8 +752,10 @@ line_completion_function (const char *te
if (list)
{
/* Free the storage used by LIST, but not by the strings inside.
- This is because rl_complete_internal () frees the strings. */
+ This is because rl_complete_internal () frees the strings.
+ As complete_line may abort by calling `error' clear LIST now. */
xfree (list);
+ list = NULL;
}
index = 0;
list = complete_line (text, line_buffer, point);
--- ./gdb/testsuite/gdb.base/completion.exp 22 Oct 2008 19:46:13 -0000 1.34
+++ ./gdb/testsuite/gdb.base/completion.exp 20 Dec 2008 00:18:50 -0000
@@ -805,6 +805,26 @@ gdb_expect {
timeout { fail "(timeout) complete 'set follow-fork-mode'" }
}
+send_gdb "p values\[0\].nonex.\t"
+sleep 1
+gdb_expect {
+ -re "Type struct some_struct has no component named nonex.\r\n$gdb_prompt $"\
+ { pass "Completing non-existing component" }
+ -re ".*$gdb_prompt $" { fail "Completing non-existing component" }
+ timeout { fail "(timeout) Completing non-existing component" }
+ eof { fail "(eof) Completing non-existing component #2" }
+ }
+# Double memory freeing gets found only on the second run:
+send_gdb "p values\[0\].nonex.\t"
+sleep 1
+gdb_expect {
+ -re "Type struct some_struct has no component named nonex.\r\n$gdb_prompt $"\
+ { pass "Completing non-existing component #2" }
+ -re ".*$gdb_prompt $" { fail "Completing non-existing component #2" }
+ timeout { fail "(timeout) Completing non-existing component #2" }
+ eof { fail "(eof) Completing non-existing component #2" }
+ }
+
# Restore globals modified in this test...
if [info exists old_inputrc] {
set env(INPUTRC) $old_inputrc