diff options
| author | Tom Tromey <tom@tromey.com> | 2018-07-29 19:21:01 -0600 |
|---|---|---|
| committer | Tom Tromey <tom@tromey.com> | 2018-11-29 10:47:42 -0700 |
| commit | d105de22fc385da878e8db44c9503a7f30419322 (patch) | |
| tree | 0c14538cb98df9bb05c66cef9ca25286feab9bf7 /gdb/gdbserver/target.h | |
| parent | e368bf56d38afecd1ac0e19c9e9cb54e2bb4fad2 (diff) | |
| download | gdb-d105de22fc385da878e8db44c9503a7f30419322.zip gdb-d105de22fc385da878e8db44c9503a7f30419322.tar.gz gdb-d105de22fc385da878e8db44c9503a7f30419322.tar.bz2 | |
Fix use-after-free in gdbserver
-fsanitize=address pointed out a use-after-free in gdbserver. In
particular, handle_detach could reference "process" after it was
deleted by detach_inferior. Avoiding this also necessitated changing
target_ops::join to take a pid rather than a process_info*.
Tested by the buildbot using a few of the gdbserver builders.
gdb/gdbserver/ChangeLog
2018-11-29 Tom Tromey <tom@tromey.com>
* win32-low.c (win32_join): Take pid, not process.
* target.h (struct target_ops) <join>: Change argument type.
(join_inferior): Change argument name.
* spu-low.c (spu_join): Take pid, not process.
* server.c (handle_detach): Preserve pid before destroying
process.
* lynx-low.c (lynx_join): Take pid, not process.
* linux-low.c (linux_join): Take pid, not process.
Diffstat (limited to 'gdb/gdbserver/target.h')
| -rw-r--r-- | gdb/gdbserver/target.h | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/gdb/gdbserver/target.h b/gdb/gdbserver/target.h index fce54e0..6f810b6 100644 --- a/gdb/gdbserver/target.h +++ b/gdb/gdbserver/target.h @@ -103,9 +103,9 @@ struct target_ops void (*mourn) (struct process_info *proc); - /* Wait for process PROC to exit. */ + /* Wait for process PID to exit. */ - void (*join) (process_info *proc); + void (*join) (int pid); /* Return 1 iff the thread with process ID PID is alive. */ @@ -530,8 +530,8 @@ int kill_inferior (process_info *proc); #define store_inferior_registers(regcache, regno) \ (*the_target->store_registers) (regcache, regno) -#define join_inferior(proc) \ - (*the_target->join) (proc) +#define join_inferior(pid) \ + (*the_target->join) (pid) #define target_supports_non_stop() \ (the_target->supports_non_stop ? (*the_target->supports_non_stop ) () : 0) |