[RFA] PR gdb/17210 - fix possible memory leak in read_memory_robust

  PR gdb/17210 concerns a possible memory leak in read_memory_robust.
The bug can happen because read_memory_robust allocates memory, does
not install any cleanups, and invokes QUIT.  Similarly, it target_read
calls QUIT, so it too can potentially throw.

The fix is to install cleanups to guard the allocated memory.

Built and regtested on x86-64 Fedora 23.  I couldn't think of a way to
test this, so no new test; and of course this means it should have
more careful review.

2016-06-09  Tom Tromey  <tom@tromey.com>

	PR gdb/17210:
	* target.c (free_memory_read_result_vector): Take a pointer to the
	VEC as an argument.
	(read_memory_robust): Install a cleanup for "result".
	* mi/mi-main.c (mi_cmd_data_read_memory_bytes): Update.
---
 gdb/ChangeLog    |  8 ++++++++
 gdb/mi/mi-main.c |  2 +-
 gdb/target.c     | 15 +++++++++++----
 3 files changed, 20 insertions(+), 5 deletions(-)
  

On Thu, Jun 9, 2016 at 5:33 PM, Tom Tromey <tom@tromey.com> wrote:
>
>  VEC(memory_read_result_s) *
> @@ -1810,6 +1810,8 @@ read_memory_robust (struct target_ops *ops,
>  {
>    VEC(memory_read_result_s) *result = 0;
>    int unit_size = gdbarch_addressable_memory_unit_size (target_gdbarch ());
> +  struct cleanup *cleanup = make_cleanup (free_memory_read_result_vector,
> +                                         &result);
>

result is a local variable on stack, so its address is meaningless when the
exception is throw, because the stack has already been destroyed.

Probably, we can register cleanup for result once it becomes to non-NULL,
and changes in free_memory_read_result_vector are not needed.
  

>>>>> "Yao" == Yao Qi <qiyaoltc@gmail.com> writes:

Yao> On Thu, Jun 9, 2016 at 5:33 PM, Tom Tromey <tom@tromey.com> wrote:
>> 
>> VEC(memory_read_result_s) *
>> @@ -1810,6 +1810,8 @@ read_memory_robust (struct target_ops *ops,
>> {
>> VEC(memory_read_result_s) *result = 0;
>> int unit_size = gdbarch_addressable_memory_unit_size (target_gdbarch ());
>> +  struct cleanup *cleanup = make_cleanup (free_memory_read_result_vector,
>> +                                         &result);
>> 

Yao> result is a local variable on stack, so its address is meaningless when the
Yao> exception is throw, because the stack has already been destroyed.

Yao> Probably, we can register cleanup for result once it becomes to non-NULL,
Yao> and changes in free_memory_read_result_vector are not needed.

I don't think that will work, because resizing the vector may cause the
value to change.  Though one option would be to discard the cleanup and
recreate it after each push.

Tom
  

On 06/28/2016 11:42 AM, Yao Qi wrote:
> On Thu, Jun 9, 2016 at 5:33 PM, Tom Tromey <tom@tromey.com> wrote:
>>
>>  VEC(memory_read_result_s) *
>> @@ -1810,6 +1810,8 @@ read_memory_robust (struct target_ops *ops,
>>  {
>>    VEC(memory_read_result_s) *result = 0;
>>    int unit_size = gdbarch_addressable_memory_unit_size (target_gdbarch ());
>> +  struct cleanup *cleanup = make_cleanup (free_memory_read_result_vector,
>> +                                         &result);
>>
> 
> result is a local variable on stack, so its address is meaningless when the
> exception is throw, because the stack has already been destroyed.

Can you clarify?
Cleanups do run before the stack is destroyed.  See most 
free_current_contents users.

Thanks,
Pedro Alves
  

On Tue, Jun 28, 2016 at 6:47 PM, Pedro Alves <palves@redhat.com> wrote:
> On 06/28/2016 11:42 AM, Yao Qi wrote:
>> On Thu, Jun 9, 2016 at 5:33 PM, Tom Tromey <tom@tromey.com> wrote:
>>>
>>>  VEC(memory_read_result_s) *
>>> @@ -1810,6 +1810,8 @@ read_memory_robust (struct target_ops *ops,
>>>  {
>>>    VEC(memory_read_result_s) *result = 0;
>>>    int unit_size = gdbarch_addressable_memory_unit_size (target_gdbarch ());
>>> +  struct cleanup *cleanup = make_cleanup (free_memory_read_result_vector,
>>> +                                         &result);
>>>
>>
>> result is a local variable on stack, so its address is meaningless when the
>> exception is throw, because the stack has already been destroyed.
>
> Can you clarify?
> Cleanups do run before the stack is destroyed.  See most
> free_current_contents users.

Urr.. right... do_cleanups is called when the exception is thrown
where the stack
is not destroyed yet.  I thought do_cleanups is called when gdb goes back to
the top level in this case.

Tom, the patch is good to me then.