diff options
| author | Tom Tromey <tom@tromey.com> | 2016-06-09 09:46:53 -0600 |
|---|---|---|
| committer | Tom Tromey <tom@tromey.com> | 2016-06-29 10:03:45 -0600 |
| commit | 9d78f827e0da9ab6fda2d6ef2d59cebb805b411f (patch) | |
| tree | d68e95e4e3f51f476d6cd21f9c69609545a168b1 /gdb/target.c | |
| parent | b287eca391bbb10e709fb8ba9a56be166ab2ff1d (diff) | |
PR gdb/17210 - fix possible memory leak in read_memory_robust
PR gdb/17210 concerns a possible memory leak in read_memory_robust.
The bug can happen because read_memory_robust allocates memory, does
not install any cleanups, and invokes QUIT. Similarly, target_read
calls QUIT, so it too can potentially throw.
The fix is to install cleanups to guard the allocated memory.
Built and regtested on x86-64 Fedora 23. I couldn't think of a way to
test this, so no new test; and of course this means it should have
more careful review.
2016-06-29 Tom Tromey <tom@tromey.com>
PR gdb/17210:
* target.c (free_memory_read_result_vector): Take a pointer to the
VEC as an argument.
(read_memory_robust): Install a cleanup for "result".
* mi/mi-main.c (mi_cmd_data_read_memory_bytes): Update.
Diffstat (limited to 'gdb/target.c')
| -rw-r--r-- | gdb/target.c | 15 |
1 files changed, 11 insertions, 4 deletions
diff --git a/gdb/target.c b/gdb/target.c index 6f69ac37a1..bb86adf9b7 100644 --- a/gdb/target.c +++ b/gdb/target.c @@ -1825,15 +1825,15 @@ read_whatever_is_readable (struct target_ops *ops, void free_memory_read_result_vector (void *x) { - VEC(memory_read_result_s) *v = (VEC(memory_read_result_s) *) x; + VEC(memory_read_result_s) **v = (VEC(memory_read_result_s) **) x; memory_read_result_s *current; int ix; - for (ix = 0; VEC_iterate (memory_read_result_s, v, ix, current); ++ix) + for (ix = 0; VEC_iterate (memory_read_result_s, *v, ix, current); ++ix) { xfree (current->data); } - VEC_free (memory_read_result_s, v); + VEC_free (memory_read_result_s, *v); } VEC(memory_read_result_s) * @@ -1842,6 +1842,8 @@ read_memory_robust (struct target_ops *ops, { VEC(memory_read_result_s) *result = 0; int unit_size = gdbarch_addressable_memory_unit_size (target_gdbarch ()); + struct cleanup *cleanup = make_cleanup (free_memory_read_result_vector, + &result); LONGEST xfered_total = 0; while (xfered_total < len) @@ -1868,6 +1870,7 @@ read_memory_robust (struct target_ops *ops, { LONGEST to_read = min (len - xfered_total, region_len); gdb_byte *buffer = (gdb_byte *) xmalloc (to_read * unit_size); + struct cleanup *inner_cleanup = make_cleanup (xfree, buffer); LONGEST xfered_partial = target_read (ops, TARGET_OBJECT_MEMORY, NULL, @@ -1878,7 +1881,7 @@ read_memory_robust (struct target_ops *ops, { /* Got an error reading full chunk. See if maybe we can read some subrange. */ - xfree (buffer); + do_cleanups (inner_cleanup); read_whatever_is_readable (ops, offset + xfered_total, offset + xfered_total + to_read, unit_size, &result); @@ -1887,6 +1890,8 @@ read_memory_robust (struct target_ops *ops, else { struct memory_read_result r; + + discard_cleanups (inner_cleanup); r.data = buffer; r.begin = offset + xfered_total; r.end = r.begin + xfered_partial; @@ -1896,6 +1901,8 @@ read_memory_robust (struct target_ops *ops, QUIT; } } + + discard_cleanups (cleanup); return result; } |