From 33af066d07d495c81c7c102125aec8dbac62c27b Mon Sep 17 00:00:00 2001 From: Tom Tromey Date: Sun, 5 Dec 2021 13:13:33 -0700 Subject: [PATCH] Preserve artificial CU name in process_psymtab_comp_unit_reader This fixes a use-after-free that Simon pointed out. process_psymtab_comp_unit_reader was allocating an artificial name for a CU, and then discarding it. However, this name was preserved in the cached file_and_directory. This patch arranges for the allocated name to be preserved there. --- gdb/dwarf2/file-and-dir.h | 8 ++++++-- gdb/dwarf2/read.c | 10 +++++----- 2 files changed, 11 insertions(+), 7 deletions(-) diff --git a/gdb/dwarf2/file-and-dir.h b/gdb/dwarf2/file-and-dir.h index 1a9ccf35829..c56922ff90d 100644 --- a/gdb/dwarf2/file-and-dir.h +++ b/gdb/dwarf2/file-and-dir.h @@ -84,9 +84,10 @@ struct file_and_directory } /* Set the filename. */ - void set_name (const char *name) + void set_name (gdb::unique_xmalloc_ptr name) { - m_name = name; + m_name_storage = std::move (name); + m_name = m_name_storage.get (); } private: @@ -94,6 +95,9 @@ private: /* The filename. */ const char *m_name; + /* Storage for the filename, if needed. */ + gdb::unique_xmalloc_ptr m_name_storage; + /* The compilation directory. NULL if not known. If we needed to compute a new string, it will be stored in the comp_dir_storage member, and this will be NULL. Otherwise, points directly to the diff --git a/gdb/dwarf2/read.c b/gdb/dwarf2/read.c index ff5758eb0a4..f2d7da7de52 100644 --- a/gdb/dwarf2/read.c +++ b/gdb/dwarf2/read.c @@ -6986,15 +6986,15 @@ process_psymtab_comp_unit_reader (const struct die_reader_specs *reader, prepare_one_comp_unit (cu, comp_unit_die, pretend_language); /* Allocate a new partial symbol table structure. */ - gdb::unique_xmalloc_ptr debug_filename; static const char artificial[] = ""; file_and_directory &fnd = find_file_and_directory (comp_unit_die, cu); if (strcmp (fnd.get_name (), artificial) == 0) { - debug_filename.reset (concat (artificial, "@", - sect_offset_str (per_cu->sect_off), - (char *) NULL)); - fnd.set_name (debug_filename.get ()); + gdb::unique_xmalloc_ptr debug_filename + (concat (artificial, "@", + sect_offset_str (per_cu->sect_off), + (char *) NULL)); + fnd.set_name (std::move (debug_filename)); } pst = create_partial_symtab (per_cu, per_objfile, fnd.get_name ()); -- 2.30.2