Skip to content

Commit

Permalink
Fix crash on Python frame filters with unreadable arg
Browse files Browse the repository at this point in the history 
https://bugzilla.redhat.com/show_bug.cgi?id=1126177

ERROR: AddressSanitizer: SEGV on unknown address 0x000000000050 (pc 0x000000992bef sp 0x7ffff9039530 bp 0x7ffff9039540
T0)
    #0 0x992bee in value_type .../gdb/value.c:925
    #1 0x87c951 in py_print_single_arg python/py-framefilter.c:445
    #2 0x87cfae in enumerate_args python/py-framefilter.c:596
    #3 0x87e0b0 in py_print_args python/py-framefilter.c:968

It crashes because frame_arg::val is documented it may contain NULL
(frame_arg::error is then non-NULL) but the code does not handle it.

Another bug is that py_print_single_arg() calls goto out of its TRY_CATCH
which messes up GDB cleanup chain crashing GDB later.

It is probably 7.7 regression (I have not verified it) due to the introduction
of Python frame filters.

gdb/ChangeLog

	PR python/17355
	* python/py-framefilter.c (py_print_single_arg): Handle NULL FA->VAL.
	Fix goto out of TRY_CATCH.

gdb/testsuite/ChangeLog

	PR python/17355
	* gdb.python/amd64-py-framefilter-invalidarg.S: New file.
	* gdb.python/py-framefilter-invalidarg-gdb.py.in: New file.
	* gdb.python/py-framefilter-invalidarg.exp: New file.
	* gdb.python/py-framefilter-invalidarg.py: New file.
  • Loading branch information
@jankratochvil
jankratochvil committed Sep 7, 2014
1 parent 3f9d876 commit c75bd3a
Show file tree
Hide file tree
Showing 7 changed files with 467 additions and 15 deletions.
6 changes: 6 additions & 0 deletions gdb/ChangeLog
View file
Original file line number Diff line number Diff line change
@@ -1,3 +1,9 @@
2014-09-07 Jan Kratochvil <[email protected]>

PR python/17355
* python/py-framefilter.c (py_print_single_arg): Handle NULL FA->VAL.
Fix goto out of TRY_CATCH.

2014-09-06 Doug Evans <[email protected]>
Tom Tromey <[email protected]>

Expand Down
33 changes: 18 additions & 15 deletions gdb/python/py-framefilter.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -365,9 +365,12 @@ py_print_single_arg (struct ui_out *out,
{
struct value *val;
volatile struct gdb_exception except;
enum ext_lang_bt_status retval = EXT_LANG_BT_OK;

if (fa != NULL)
{
if (fa->val == NULL && fa->error == NULL)
return EXT_LANG_BT_OK;
language = language_def (SYMBOL_LANGUAGE (fa->sym));
val = fa->val;
}
Expand Down Expand Up @@ -433,16 +436,18 @@ py_print_single_arg (struct ui_out *out,
/* For MI print the type, but only for simple values. This seems
weird, but this is how MI choose to format the various output
types. */
if (args_type == MI_PRINT_SIMPLE_VALUES)
if (args_type == MI_PRINT_SIMPLE_VALUES && val != NULL)
{
if (py_print_type (out, val) == EXT_LANG_BT_ERROR)
{
retval = EXT_LANG_BT_ERROR;
do_cleanups (cleanups);
goto error;
continue;
}
}

annotate_arg_value (value_type (val));
if (val != NULL)
annotate_arg_value (value_type (val));

/* If the output is to the CLI, and the user option "set print
frame-arguments" is set to none, just output "...". */
Expand All @@ -454,27 +459,25 @@ py_print_single_arg (struct ui_out *out,
for the case of MI_PRINT_NO_VALUES. */
if (args_type != NO_VALUES)
{
if (py_print_value (out, val, opts, 0, args_type, language)
== EXT_LANG_BT_ERROR)
if (val == NULL)
{
do_cleanups (cleanups);
goto error;
gdb_assert (fa != NULL && fa->error != NULL);
ui_out_field_fmt (out, "value",
_("<error reading variable: %s>"),
fa->error);
}
else if (py_print_value (out, val, opts, 0, args_type, language)
== EXT_LANG_BT_ERROR)
retval = EXT_LANG_BT_ERROR;
}
}

do_cleanups (cleanups);
}
if (except.reason < 0)
{
gdbpy_convert_exception (except);
goto error;
}

return EXT_LANG_BT_OK;
gdbpy_convert_exception (except);

error:
return EXT_LANG_BT_ERROR;
return retval;
}

/* Helper function to loop over frame arguments provided by the
Expand Down
8 changes: 8 additions & 0 deletions gdb/testsuite/ChangeLog
View file
Original file line number Diff line number Diff line change
@@ -1,3 +1,11 @@
2014-09-07 Jan Kratochvil <[email protected]>

PR python/17355
* gdb.python/amd64-py-framefilter-invalidarg.S: New file.
* gdb.python/py-framefilter-invalidarg-gdb.py.in: New file.
* gdb.python/py-framefilter-invalidarg.exp: New file.
* gdb.python/py-framefilter-invalidarg.py: New file.

2014-09-06 Doug Evans <[email protected]>

PR 15276
Expand Down
261 changes: 261 additions & 0 deletions gdb/testsuite/gdb.python/amd64-py-framefilter-invalidarg.S
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,261 @@
/* This testcase is part of GDB, the GNU debugger.
Copyright 2014 Free Software Foundation, Inc.
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>. */

/* This file is compiled from a single line
int main (int argc, char **argv) { return 0; }
using -g -dA -S -O2 and patched as #if-ed below. */

.file "py-framefilter-invalidarg.c"
.text
.Ltext0:
.globl main
.type main, @function
main:
.LFB0:
.file 1 "py-framefilter-invalidarg.c"
# py-framefilter-invalidarg.c:1
.loc 1 1 0
.cfi_startproc
# BLOCK 2 seq:0
# PRED: ENTRY (FALLTHRU)
pushq %rbp
.cfi_def_cfa_offset 16
.cfi_offset 6, -16
movq %rsp, %rbp
.cfi_def_cfa_register 6
movl %edi, -4(%rbp)
movq %rsi, -16(%rbp)
# py-framefilter-invalidarg.c:2
.loc 1 2 0
movl $0, %eax
# py-framefilter-invalidarg.c:3
.loc 1 3 0
popq %rbp
.cfi_def_cfa 7, 8
# SUCC: EXIT [100.0%]
ret
.cfi_endproc
.LFE0:
.size main, .-main
.Letext0:
.section .debug_info,"",@progbits
.Ldebug_info0:
.long .Le - .Ls # Length of Compilation Unit Info
.Ls:
.value 0x4 # DWARF version number
.long .Ldebug_abbrev0 # Offset Into Abbrev. Section
.byte 0x8 # Pointer Size (in bytes)
.uleb128 0x1 # (DIE (0xb) DW_TAG_compile_unit)
.long .LASF3 # DW_AT_producer: "GNU C 4.9.1 20140813 (Red Hat 4.9.1-7) -mtune=generic -march=x86-64 -g"
.byte 0x1 # DW_AT_language
.long .LASF4 # DW_AT_name: "py-framefilter-invalidarg.c"
.long .LASF5 # DW_AT_comp_dir: ""
.quad .Ltext0 # DW_AT_low_pc
.quad .Letext0-.Ltext0 # DW_AT_high_pc
.long .Ldebug_line0 # DW_AT_stmt_list
die2d:
.uleb128 0x2 # (DIE (0x2d) DW_TAG_subprogram)
# DW_AT_external
.long .LASF6 # DW_AT_name: "main"
.byte 0x1 # DW_AT_decl_file (py-framefilter-invalidarg.c)
.byte 0x1 # DW_AT_decl_line
# DW_AT_prototyped
.long die6b-.Ldebug_info0 # DW_AT_type
.quad .LFB0 # DW_AT_low_pc
.quad .LFE0-.LFB0 # DW_AT_high_pc
.uleb128 0x1 # DW_AT_frame_base
.byte 0x9c # DW_OP_call_frame_cfa
# DW_AT_GNU_all_call_sites
die4e:
.uleb128 0x3 # (DIE (0x4e) DW_TAG_formal_parameter)
.long .LASF0 # DW_AT_name: "argc"
.byte 0x1 # DW_AT_decl_file (py-framefilter-invalidarg.c)
.byte 0x1 # DW_AT_decl_line
.long die6b-.Ldebug_info0 # DW_AT_type
#if 0
.uleb128 0x2 # DW_AT_location
.byte 0x91 # DW_OP_fbreg
.sleb128 -20
#endif
#if 0
.uleb128 1f - 2f # DW_AT_location
2:
.byte 0x03 # DW_OP_addr
.quad 0
1:
#endif
#if 1
.uleb128 1f - 2f # DW_AT_location
2:
.byte 0x13 # DW_OP_drop
.quad 0
1:
#endif
die5c:
.uleb128 0x3 # (DIE (0x5c) DW_TAG_formal_parameter)
.long .LASF1 # DW_AT_name: "argv"
.byte 0x1 # DW_AT_decl_file (py-framefilter-invalidarg.c)
.byte 0x1 # DW_AT_decl_line
.long die72-.Ldebug_info0 # DW_AT_type
.uleb128 0x2 # DW_AT_location
.byte 0x91 # DW_OP_fbreg
.sleb128 -32
.byte 0 # end of children of DIE 0x2d
die6b:
.uleb128 0x4 # (DIE (0x6b) DW_TAG_base_type)
.byte 0x4 # DW_AT_byte_size
.byte 0x5 # DW_AT_encoding
.ascii "int\0" # DW_AT_name
die72:
.uleb128 0x5 # (DIE (0x72) DW_TAG_pointer_type)
.byte 0x8 # DW_AT_byte_size
.long die78-.Ldebug_info0 # DW_AT_type
die78:
.uleb128 0x5 # (DIE (0x78) DW_TAG_pointer_type)
.byte 0x8 # DW_AT_byte_size
.long die7e-.Ldebug_info0 # DW_AT_type
die7e:
.uleb128 0x6 # (DIE (0x7e) DW_TAG_base_type)
.byte 0x1 # DW_AT_byte_size
.byte 0x6 # DW_AT_encoding
.long .LASF2 # DW_AT_name: "char"
.byte 0 # end of children of DIE 0xb
.Le:
.section .debug_abbrev,"",@progbits
.Ldebug_abbrev0:
.uleb128 0x1 # (abbrev code)
.uleb128 0x11 # (TAG: DW_TAG_compile_unit)
.byte 0x1 # DW_children_yes
.uleb128 0x25 # (DW_AT_producer)
.uleb128 0xe # (DW_FORM_strp)
.uleb128 0x13 # (DW_AT_language)
.uleb128 0xb # (DW_FORM_data1)
.uleb128 0x3 # (DW_AT_name)
.uleb128 0xe # (DW_FORM_strp)
.uleb128 0x1b # (DW_AT_comp_dir)
.uleb128 0xe # (DW_FORM_strp)
.uleb128 0x11 # (DW_AT_low_pc)
.uleb128 0x1 # (DW_FORM_addr)
.uleb128 0x12 # (DW_AT_high_pc)
.uleb128 0x7 # (DW_FORM_data8)
.uleb128 0x10 # (DW_AT_stmt_list)
.uleb128 0x17 # (DW_FORM_sec_offset)
.byte 0
.byte 0
.uleb128 0x2 # (abbrev code)
.uleb128 0x2e # (TAG: DW_TAG_subprogram)
.byte 0x1 # DW_children_yes
.uleb128 0x3f # (DW_AT_external)
.uleb128 0x19 # (DW_FORM_flag_present)
.uleb128 0x3 # (DW_AT_name)
.uleb128 0xe # (DW_FORM_strp)
.uleb128 0x3a # (DW_AT_decl_file)
.uleb128 0xb # (DW_FORM_data1)
.uleb128 0x3b # (DW_AT_decl_line)
.uleb128 0xb # (DW_FORM_data1)
.uleb128 0x27 # (DW_AT_prototyped)
.uleb128 0x19 # (DW_FORM_flag_present)
.uleb128 0x49 # (DW_AT_type)
.uleb128 0x13 # (DW_FORM_ref4)
.uleb128 0x11 # (DW_AT_low_pc)
.uleb128 0x1 # (DW_FORM_addr)
.uleb128 0x12 # (DW_AT_high_pc)
.uleb128 0x7 # (DW_FORM_data8)
.uleb128 0x40 # (DW_AT_frame_base)
.uleb128 0x18 # (DW_FORM_exprloc)
.uleb128 0x2117 # (DW_AT_GNU_all_call_sites)
.uleb128 0x19 # (DW_FORM_flag_present)
.byte 0
.byte 0
.uleb128 0x3 # (abbrev code)
.uleb128 0x5 # (TAG: DW_TAG_formal_parameter)
.byte 0 # DW_children_no
.uleb128 0x3 # (DW_AT_name)
.uleb128 0xe # (DW_FORM_strp)
.uleb128 0x3a # (DW_AT_decl_file)
.uleb128 0xb # (DW_FORM_data1)
.uleb128 0x3b # (DW_AT_decl_line)
.uleb128 0xb # (DW_FORM_data1)
.uleb128 0x49 # (DW_AT_type)
.uleb128 0x13 # (DW_FORM_ref4)
.uleb128 0x2 # (DW_AT_location)
.uleb128 0x18 # (DW_FORM_exprloc)
.byte 0
.byte 0
.uleb128 0x4 # (abbrev code)
.uleb128 0x24 # (TAG: DW_TAG_base_type)
.byte 0 # DW_children_no
.uleb128 0xb # (DW_AT_byte_size)
.uleb128 0xb # (DW_FORM_data1)
.uleb128 0x3e # (DW_AT_encoding)
.uleb128 0xb # (DW_FORM_data1)
.uleb128 0x3 # (DW_AT_name)
.uleb128 0x8 # (DW_FORM_string)
.byte 0
.byte 0
.uleb128 0x5 # (abbrev code)
.uleb128 0xf # (TAG: DW_TAG_pointer_type)
.byte 0 # DW_children_no
.uleb128 0xb # (DW_AT_byte_size)
.uleb128 0xb # (DW_FORM_data1)
.uleb128 0x49 # (DW_AT_type)
.uleb128 0x13 # (DW_FORM_ref4)
.byte 0
.byte 0
.uleb128 0x6 # (abbrev code)
.uleb128 0x24 # (TAG: DW_TAG_base_type)
.byte 0 # DW_children_no
.uleb128 0xb # (DW_AT_byte_size)
.uleb128 0xb # (DW_FORM_data1)
.uleb128 0x3e # (DW_AT_encoding)
.uleb128 0xb # (DW_FORM_data1)
.uleb128 0x3 # (DW_AT_name)
.uleb128 0xe # (DW_FORM_strp)
.byte 0
.byte 0
.byte 0
.section .debug_aranges,"",@progbits
.long 0x2c # Length of Address Ranges Info
.value 0x2 # DWARF Version
.long .Ldebug_info0 # Offset of Compilation Unit Info
.byte 0x8 # Size of Address
.byte 0 # Size of Segment Descriptor
.value 0 # Pad to 16 byte boundary
.value 0
.quad .Ltext0 # Address
.quad .Letext0-.Ltext0 # Length
.quad 0
.quad 0
.section .debug_line,"",@progbits
.Ldebug_line0:
.section .debug_str,"MS",@progbits,1
.LASF1:
.string "argv"
.LASF4:
.string "py-framefilter-invalidarg.c"
.LASF5:
.string ""
.LASF0:
.string "argc"
.LASF3:
.string "GNU C 4.9.1 20140813 (Red Hat 4.9.1-7) -mtune=generic -march=x86-64 -g"
.LASF6:
.string "main"
.LASF2:
.string "char"
.ident "GCC: (GNU) 4.9.1 20140813 (Red Hat 4.9.1-7)"
.section .note.GNU-stack,"",@progbits
Loading

0 comments on commit c75bd3a

Please sign in to comment.