From: Tom Tromey <tromey@adacore.com>
Date: Mon, 1 Jul 2019 15:33:19 +0000 (-0600)
Subject: Avoid use-after-free in DWARF debug names code
X-Git-Tag: binutils-2_33~675
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=54ee425275c759438d90c40781e3810a551f0a5f;p=external%2Fbinutils.git

Avoid use-after-free in DWARF debug names code

A static analyzer pointed out that find_vec_in_debug_names will use
the contents of a unique_ptr after it has been destroyed.  This patch
fixes the bug by hoisting the declaration into the appropriate
enclosing block.

I'm checking this in as obvious.

gdb/ChangeLog
2019-07-01  Tom Tromey  <tromey@adacore.com>

	* dwarf2read.c
	(dw2_debug_names_iterator::find_vec_in_debug_names): Hoist
	declaration of without_params.  Fix formatting.
---

diff --git a/gdb/ChangeLog b/gdb/ChangeLog
index b1fa611..4cb3f6f 100644
--- a/gdb/ChangeLog
+++ b/gdb/ChangeLog
@@ -1,5 +1,11 @@
 2019-07-01  Tom Tromey  <tromey@adacore.com>
 
+	* dwarf2read.c
+	(dw2_debug_names_iterator::find_vec_in_debug_names): Hoist
+	declaration of without_params.  Fix formatting.
+
+2019-07-01  Tom Tromey  <tromey@adacore.com>
+
 	* ada-exp.y (find_primitive_type): Update.
 	* ada-lang.h (ada_lookup_symbol): Update.
 	* ada-lang.c (ada_lookup_symbol): Remove "is_a_field_of_this"
diff --git a/gdb/dwarf2read.c b/gdb/dwarf2read.c
index d004863..f1fbba4 100644
--- a/gdb/dwarf2read.c
+++ b/gdb/dwarf2read.c
@@ -5726,6 +5726,7 @@ dw2_debug_names_iterator::find_vec_in_debug_names
 {
   int (*cmp) (const char *, const char *);
 
+  gdb::unique_xmalloc_ptr<char> without_params;
   if (current_language->la_language == language_cplus
       || current_language->la_language == language_fortran
       || current_language->la_language == language_d)
@@ -5735,13 +5736,9 @@ dw2_debug_names_iterator::find_vec_in_debug_names
 
       if (strchr (name, '(') != NULL)
 	{
-	  gdb::unique_xmalloc_ptr<char> without_params
-	    = cp_remove_params (name);
-
+	  without_params = cp_remove_params (name);
 	  if (without_params != NULL)
-	    {
-	      name = without_params.get();
-	    }
+	    name = without_params.get ();
 	}
     }