* regcache.c (new_register_cache): No need to check result of xcalloc.

	* server.c (handle_search_memory): Back out calls to xmalloc,
	result is checked and error is returned to user upon failure.
	(handle_query): Ditto.  Add more checks for result of malloc.
	(handle_v_cont): Check result of malloc, report error back to
	user upon failure.
	(handle_v_run): Ditto.  Call freeargv.
	* server.h (freeargv): Declare.
	* utils.c (freeargv): New fn.

5 files changed, 76 insertions, 21 deletions

diff --git a/gdb/gdbserver/ChangeLog b/gdb/gdbserver/ChangeLog
index a321136..530a2f1 100644
--- a/gdb/gdbserver/ChangeLog
+++ b/gdb/gdbserver/ChangeLog
@@ -1,3 +1,15 @@
+2009-01-18  Doug Evans  <dje@google.com>
+
+	* regcache.c (new_register_cache): No need to check result of xcalloc.
+	* server.c (handle_search_memory): Back out calls to xmalloc,
+	result is checked and error is returned to user upon failure.
+	(handle_query): Ditto.  Add more checks for result of malloc.
+	(handle_v_cont): Check result of malloc, report error back to
+	user upon failure.
+	(handle_v_run): Ditto.  Call freeargv.
+	* server.h (freeargv): Declare.
+	* utils.c (freeargv): New fn.
+
 2009-01-15  Doug Evans  <dje@google.com>
 
 	* gdbreplay.c (perror_with_name): Make arg const char *.
diff --git a/gdb/gdbserver/regcache.c b/gdb/gdbserver/regcache.c
index 1454574..a050a4b 100644
--- a/gdb/gdbserver/regcache.c
+++ b/gdb/gdbserver/regcache.c
@@ -100,8 +100,6 @@ new_register_cache (void)
      in case there are registers the target never fetches.  This way they'll
      read as zero instead of garbage.  */
   regcache->registers = xcalloc (1, register_bytes);
-  if (regcache->registers == NULL)
-    fatal ("Could not allocate register cache.");
 
   regcache->registers_valid = 0;
 
diff --git a/gdb/gdbserver/server.c b/gdb/gdbserver/server.c
index f2e9b05..2e97c92 100644
--- a/gdb/gdbserver/server.c
+++ b/gdb/gdbserver/server.c
@@ -436,7 +436,7 @@ handle_search_memory (char *own_buf, int packet_len)
   CORE_ADDR found_addr;
   int cmd_name_len = sizeof ("qSearch:memory:") - 1;
 
-  pattern = xmalloc (packet_len);
+  pattern = malloc (packet_len);
   if (pattern == NULL)
     {
       error ("Unable to allocate memory to perform the search");
@@ -460,7 +460,7 @@ handle_search_memory (char *own_buf, int packet_len)
   if (search_space_len < search_buf_size)
     search_buf_size = search_space_len;
 
-  search_buf = xmalloc (search_buf_size);
+  search_buf = malloc (search_buf_size);
   if (search_buf == NULL)
     {
       free (pattern);
@@ -575,7 +575,7 @@ handle_query (char *own_buf, int packet_len, int *new_packet_len_p)
 	  return;
       if (len > PBUFSIZ - 2)
 	len = PBUFSIZ - 2;
-      spu_buf = xmalloc (len + 1);
+      spu_buf = malloc (len + 1);
       if (!spu_buf)
         return;
 
@@ -604,7 +604,7 @@ handle_query (char *own_buf, int packet_len, int *new_packet_len_p)
 
       require_running (own_buf);
       strcpy (own_buf, "E00");
-      spu_buf = xmalloc (packet_len - 15);
+      spu_buf = malloc (packet_len - 15);
       if (!spu_buf)
         return;
       if (decode_xfer_write (own_buf + 16, packet_len - 16, &annex,
@@ -648,7 +648,12 @@ handle_query (char *own_buf, int packet_len, int *new_packet_len_p)
 	 more.  */
       if (len > PBUFSIZ - 2)
 	len = PBUFSIZ - 2;
-      data = xmalloc (len + 1);
+      data = malloc (len + 1);
+      if (data == NULL)
+	{
+	  write_enn (own_buf);
+	  return;
+	}
       n = (*the_target->read_auxv) (ofs, data, len + 1);
       if (n < 0)
 	write_enn (own_buf);
@@ -726,7 +731,12 @@ handle_query (char *own_buf, int packet_len, int *new_packet_len_p)
       for (dll_ptr = all_dlls.head; dll_ptr != NULL; dll_ptr = dll_ptr->next)
 	total_len += 128 + 6 * strlen (((struct dll_info *) dll_ptr)->name);
 
-      document = xmalloc (total_len);
+      document = malloc (total_len);
+      if (document == NULL)
+	{
+	  write_enn (own_buf);
+	  return;
+	}
       strcpy (document, "<library-list>\n");
       p = document + strlen (document);
 
@@ -782,7 +792,7 @@ handle_query (char *own_buf, int packet_len, int *new_packet_len_p)
        return;
       if (len > PBUFSIZ - 2)
        len = PBUFSIZ - 2;
-      workbuf = xmalloc (len + 1);
+      workbuf = malloc (len + 1);
       if (!workbuf)
         return;
 
@@ -895,9 +905,15 @@ handle_query (char *own_buf, int packet_len, int *new_packet_len_p)
   /* Handle "monitor" commands.  */
   if (strncmp ("qRcmd,", own_buf, 6) == 0)
     {
-      char *mon = xmalloc (PBUFSIZ);
+      char *mon = malloc (PBUFSIZ);
       int len = strlen (own_buf + 6);
 
+      if (mon == NULL)
+	{
+	  write_enn (own_buf);
+	  return;
+	}
+
       if ((len % 2) != 0 || unhexify (mon, own_buf + 6, len / 2) != len / 2)
 	{
 	  write_enn (own_buf);
@@ -975,7 +991,9 @@ handle_v_cont (char *own_buf, char *status, int *signal)
   /* Allocate room for one extra action, for the default remain-stopped
      behavior; if no default action is in the list, we'll need the extra
      slot.  */
-  resume_info = xmalloc ((n + 1) * sizeof (resume_info[0]));
+  resume_info = malloc ((n + 1) * sizeof (resume_info[0]));
+  if (resume_info == NULL)
+    goto err;
 
   default_action.thread = -1;
   default_action.leave_stopped = 1;
@@ -1097,7 +1115,7 @@ handle_v_attach (char *own_buf, char *status, int *signal)
 static int
 handle_v_run (char *own_buf, char *status, int *signal)
 {
-  char *p, **pp, *next_p, **new_argv;
+  char *p, *next_p, **new_argv;
   int i, new_argc;
 
   new_argc = 0;
@@ -1107,7 +1125,13 @@ handle_v_run (char *own_buf, char *status, int *signal)
       new_argc++;
     }
 
-  new_argv = xcalloc (new_argc + 2, sizeof (char *));
+  new_argv = calloc (new_argc + 2, sizeof (char *));
+  if (new_argv == NULL)
+    {
+      write_enn (own_buf);
+      return 0;
+    }
+
   i = 0;
   for (p = own_buf + strlen ("vRun;"); *p; p = next_p)
     {
@@ -1119,6 +1143,7 @@ handle_v_run (char *own_buf, char *status, int *signal)
 	new_argv[i] = NULL;
       else
 	{
+	  /* FIXME: Fail request if out of memory instead of dying.  */
 	  new_argv[i] = xmalloc (1 + (next_p - p) / 2);
 	  unhexify (new_argv[i], p, (next_p - p) / 2);
 	  new_argv[i][(next_p - p) / 2] = '\0';
@@ -1137,20 +1162,22 @@ handle_v_run (char *own_buf, char *status, int *signal)
 
       if (program_argv == NULL)
 	{
+	  /* FIXME: new_argv memory leak */
 	  write_enn (own_buf);
 	  return 0;
 	}
 
-      new_argv[0] = xstrdup (program_argv[0]);
+      new_argv[0] = strdup (program_argv[0]);
+      if (new_argv[0] == NULL)
+	{
+	  /* FIXME: new_argv memory leak */
+	  write_enn (own_buf);
+	  return 0;
+	}	  
     }
 
-  /* Free the old argv.  */
-  if (program_argv)
-    {
-      for (pp = program_argv; *pp != NULL; pp++)
-	free (*pp);
-      free (program_argv);
-    }
+  /* Free the old argv and install the new one.  */
+  freeargv (program_argv);
   program_argv = new_argv;
 
   *signal = start_inferior (program_argv, status);
diff --git a/gdb/gdbserver/server.h b/gdb/gdbserver/server.h
index 5b02dbe..6e4dfd8 100644
--- a/gdb/gdbserver/server.h
+++ b/gdb/gdbserver/server.h
@@ -276,6 +276,7 @@ const char *target_signal_to_name (enum target_signal);
 void *xmalloc (size_t) ATTR_MALLOC;
 void *xcalloc (size_t, size_t) ATTR_MALLOC;
 char *xstrdup (const char *) ATTR_MALLOC;
+void freeargv (char **argv);
 void perror_with_name (const char *string);
 void error (const char *string,...) ATTR_NORETURN ATTR_FORMAT (printf, 1, 2);
 void fatal (const char *string,...) ATTR_NORETURN ATTR_FORMAT (printf, 1, 2);
diff --git a/gdb/gdbserver/utils.c b/gdb/gdbserver/utils.c
index 7d309dd..a03c6b2 100644
--- a/gdb/gdbserver/utils.c
+++ b/gdb/gdbserver/utils.c
@@ -87,6 +87,23 @@ xstrdup (const char *s)
   return ret;
 }
 
+/* Free a standard argv vector.  */
+
+void
+freeargv (char **vector)
+{
+  char **scan;
+
+  if (vector != NULL)
+    {
+      for (scan = vector; *scan != NULL; scan++)
+	{
+	  free (*scan);
+	}
+      free (vector);
+    }
+}
+
 /* Print the system error message for errno, and also mention STRING
    as the file name for which the error was encountered.
    Then return to command level.  */