* corelow.c (core_open): Don't update the to_sections and

        to_sections_end fields in core_ops here.  It's too late.
        * irix5-nat.c (solib_add): Update the to_sections and
        to_sections_end fields in core_ops here if needed.
        * osfsolib.c (solib_add): Likewise.
        * rs6000-nat.c (xcoff_reload_core): Likewise.
        * solib.c (solib_add): Likewise.
        * somsolib.c (solib_add): Likewise.

6 files changed, 70 insertions, 7 deletions

diff --git a/gdb/ChangeLog b/gdb/ChangeLog
index 295de22..350f711 100644
--- a/gdb/ChangeLog
+++ b/gdb/ChangeLog
@@ -1,3 +1,14 @@
+Thu Oct 12 13:36:15 1995  Jeffrey A Law  (law@cygnus.com)
+
+	* corelow.c (core_open): Don't update the to_sections and
+	to_sections_end fields in core_ops here.  It's too late.
+	* irix5-nat.c (solib_add): Update the to_sections and
+	to_sections_end fields in core_ops here if needed.
+	* osfsolib.c (solib_add): Likewise.
+	* rs6000-nat.c (xcoff_reload_core): Likewise.
+	* solib.c (solib_add): Likewise.
+	* somsolib.c (solib_add): Likewise.
+
 Wed Oct 11 17:25:59 1995  Fred Fish  <fnf@rtl.cygnus.com>
 
 	* Makefile.in (VERSION): Bump version to 4.15.1
diff --git a/gdb/corelow.c b/gdb/corelow.c
index 014ef10..d937057 100644
--- a/gdb/corelow.c
+++ b/gdb/corelow.c
@@ -210,13 +210,6 @@ core_open (filename, from_tty)
 #ifdef SOLIB_ADD
       catch_errors (solib_add_stub, &from_tty, (char *)0,
 		    RETURN_MASK_ALL);
-
-      /* solib_add_stub usually modifies current_target.to_sections, which
-	 has to be reflected in core_ops to enable proper freeing of
-	 the to_sections vector in core_close and correct section
-	 mapping in xfer_memory and core_files_info.  */
-      core_ops.to_sections = current_target.to_sections;
-      core_ops.to_sections_end = current_target.to_sections_end;
 #endif
 
       /* Now, set up the frame cache, and print the top of stack.  */
diff --git a/gdb/irix5-nat.c b/gdb/irix5-nat.c
index 3bfaef7..3ba00b1 100644
--- a/gdb/irix5-nat.c
+++ b/gdb/irix5-nat.c
@@ -621,6 +621,13 @@ solib_add (arg_string, from_tty, target)
       
       if (count)
 	{
+	  int update_coreops;
+
+	  /* We must update the to_sections field in the core_ops structure
+	     here, otherwise we dereference a potential dangling pointer
+	     for each call to target_read/write_memory within this routine.  */
+	  update_coreops = core_ops.to_sections == target->to_sections;
+	     
 	  /* Reallocate the target's section table including the new size.  */
 	  if (target -> to_sections)
 	    {
@@ -637,6 +644,14 @@ solib_add (arg_string, from_tty, target)
 	    }
 	  target -> to_sections_end = target -> to_sections + (count + old);
 	  
+	  /* Update the to_sections field in the core_ops structure
+	     if needed.  */
+	  if (update_coreops)
+	    {
+	      core_ops.to_sections = target->to_sections;
+	      core_ops.to_sections_end = target->to_sections_end;
+	    }
+
 	  /* Add these section table entries to the target's table.  */
 	  while ((so = find_solib (so)) != NULL)
 	    {
diff --git a/gdb/osfsolib.c b/gdb/osfsolib.c
index 86d9606..d2b5530 100644
--- a/gdb/osfsolib.c
+++ b/gdb/osfsolib.c
@@ -625,6 +625,13 @@ solib_add (arg_string, from_tty, target)
       
       if (count)
 	{
+	  int update_coreops;
+
+	  /* We must update the to_sections field in the core_ops structure
+	     here, otherwise we dereference a potential dangling pointer
+	     for each call to target_read/write_memory within this routine.  */
+	  update_coreops = core_ops.to_sections == target->to_sections;
+	     
 	  /* Reallocate the target's section table including the new size.  */
 	  if (target -> to_sections)
 	    {
@@ -641,6 +648,14 @@ solib_add (arg_string, from_tty, target)
 	    }
 	  target -> to_sections_end = target -> to_sections + (count + old);
 	  
+	  /* Update the to_sections field in the core_ops structure
+	     if needed.  */
+	  if (update_coreops)
+	    {
+	      core_ops.to_sections = target->to_sections;
+	      core_ops.to_sections_end = target->to_sections_end;
+	    }
+
 	  /* Add these section table entries to the target's table.  */
 	  while ((so = find_solib (so)) != NULL)
 	    {
diff --git a/gdb/rs6000-nat.c b/gdb/rs6000-nat.c
index 996cba9..e6e90ee 100644
--- a/gdb/rs6000-nat.c
+++ b/gdb/rs6000-nat.c
@@ -738,6 +738,11 @@ xcoff_relocate_core (target)
 	{
 	  int count;
 	  struct section_table *stp;
+	  int update_coreops;
+
+	  /* We must update the to_sections field in the core_ops structure
+	     now to avoid dangling pointer dereferences.  */
+	  update_coreops = core_ops.to_sections === target->to_sections;
 	  
 	  count = target->to_sections_end - target->to_sections;
 	  count += 2;
@@ -745,6 +750,14 @@ xcoff_relocate_core (target)
 	    xrealloc (target->to_sections,
 		      sizeof (struct section_table) * count);
 	  target->to_sections_end = target->to_sections + count;
+
+	  /* Update the to_sections field in the core_ops structure
+	     if needed.  */
+	  if (update_coreops)
+	    {
+	      core_ops.to_sections = target->to_sections;
+	      core_ops.to_sections_end = target->to_sections_end;
+	    }
 	  stp = target->to_sections_end - 2;
 
 	  /* "Why do we add bfd_section_vma?", I hear you cry.
diff --git a/gdb/somsolib.c b/gdb/somsolib.c
index 16d9fa0..2744e5c 100644
--- a/gdb/somsolib.c
+++ b/gdb/somsolib.c
@@ -405,6 +405,12 @@ som_solib_add (arg_string, from_tty, target)
       if (status != 0)
 	{
 	  int old, new;
+	  int update_coreops;
+
+	  /* We must update the to_sections field in the core_ops structure
+	     here, otherwise we dereference a potential dangling pointer
+	     for each call to target_read/write_memory within this routine.  */
+	  update_coreops = core_ops.to_sections == target->to_sections;
 
 	  new = new_so->sections_end - new_so->sections;
 	  /* Add sections from the shared library to the core target.  */
@@ -422,6 +428,16 @@ som_solib_add (arg_string, from_tty, target)
 		xmalloc ((sizeof (struct section_table)) * new);
 	    }
 	  target->to_sections_end = (target->to_sections + old + new);
+
+	  /* Update the to_sections field in the core_ops structure
+	     if needed.  */
+	  if (update_coreops)
+	    {
+	      core_ops.to_sections = target->to_sections;
+	      core_ops.to_sections_end = target->to_sections_end;
+	    }
+
+	  /* Copy over the old data before it gets clobbered.  */
 	  memcpy ((char *)(target->to_sections + old),
 		  new_so->sections,
 		  ((sizeof (struct section_table)) * new));