Bug 682891 - [MI] crash on use-after-free types in check_typedef()
Summary: [MI] crash on use-after-free types in check_typedef()
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: gdb
Version: 6.1
Hardware: i686
OS: Linux
high
high
Target Milestone: rc
: ---
Assignee: Jan Kratochvil
QA Contact: qe-baseos-tools-bugs
URL:
Whiteboard: abrt_hash:a1fd5a303a652d1340f7b7e567a...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2011-03-07 22:04 UTC by Jan Kratochvil
Modified: 2018-11-14 12:37 UTC (History)
2 users (show)

Fixed In Version: gdb-7.2-45.el6
Doc Type: Bug Fix
Doc Text:
GDB crashed when attempting to access dynamic types, such as variable length arrays, using the GDB/MI interface. GDB now no longer crashes under these circumstances.
Clone Of: 682286
Environment:
Last Closed: 2011-05-19 13:48:51 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2011:0638 0 normal SHIPPED_LIVE gdb bug fix and enhancement update 2011-05-18 17:55:45 UTC

Description Jan Kratochvil 2011-03-07 22:04:50 UTC
+++ This bug was initially created as a clone of Bug #682286 +++

cmdline: gdb --interpreter=mi2 -quiet

How to reproduce
-----
1. Open KDevelop 4.1.2 (shipped with Fedora 14).
2. Create a C++ project (CMake) with a simple hello world-like code (needs at least 2 executable lines).
3. Place a breakpoint in an executable line.
4. Compile the project.
5. Debug the project.
6. When the execution reaches the breakpoint and stops, select 'Step Over' the statement.

GDB crashes at that point

--- Additional comment from jan.kratochvil on 2011-03-05 08:02:00 CET ---

I thought the archer-jankratochvil-vla branch has the unfinished types garbage collector disabled but it was enabled.  varobj (=MI) did not properly mark the types as still used and thus a freed memory access happened, I am sorry.
Disabled the garbage collector for now.

-------------------------------------------------------------------------------

It affects only MI - that is front ends like Eclipse.

devel_ack:
Fix - disable free_all_types():
http://pkgs.fedoraproject.org/gitweb/?p=gdb.git;a=blob_plain;f=gdb-vla-gc-disable.patch;hb=f14/master

qa_ack: I will try to create a reproducer.

Comment 3 Eva Kopalova 2011-04-05 15:59:04 UTC
    Technical note added. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    New Contents:
GDB crashed when attempting to access dynamic types, such as variable length arrays, using the GDB/MI interface. GDB now no longer crashes under these circumstances.

Comment 7 errata-xmlrpc 2011-05-19 13:48:51 UTC
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHBA-2011-0638.html


Note You need to log in before you can comment on or make changes to this bug.