Fix use-after-free in number_or_range_parser

-fsanitize=address showed a use-after-free in number_or_range_parser.

The cause was that handle_line_of_input could stash the input into
"saved_command_line", and then this could be freed by reentrant calls.

This fixes the bug by preventing commands that are read by "commands"
from being eligible for repeating.

2018-08-17  Tom Tromey  <tom@tromey.com>

	* cli/cli-script.c (read_next_line): Pass 0 as repeat argument to
	command_line_input.

diff --git a/gdb/ChangeLog b/gdb/ChangeLog
index 7988447..f7f1a05 100644 (file)
--- a/gdb/ChangeLog
+++ b/gdb/ChangeLog
@@ -1,3 +1,8 @@
+2018-08-17  Tom Tromey  <tom@tromey.com>
+
+       * cli/cli-script.c (read_next_line): Pass 0 as repeat argument to
+       command_line_input.
+
 2018-07-13  Simon Marchi  <simon.marchi@polymtl.ca>
 
        * symfile.c (set_objfile_default_section_offset): Remove struct

diff --git a/gdb/cli/cli-script.c b/gdb/cli/cli-script.c
index 87ebf9f..4c30e76 100644 (file)
--- a/gdb/cli/cli-script.c
+++ b/gdb/cli/cli-script.c
@@ -903,7 +903,7 @@ read_next_line (void)
   else
     prompt_ptr = NULL;
 
-  return command_line_input (prompt_ptr, from_tty, "commands");
+  return command_line_input (prompt_ptr, 0, "commands");
 }
 
 /* Return true if CMD's name is NAME.  */