Bug 12217

Summary: gdb segfaults while using strace command with no arguments
Product: gdb Reporter: Dennis Francis <dennisfrancis.in>
Component: breakpointsAssignee: Not yet assigned to anyone <unassigned>
Status: RESOLVED FIXED    
Severity: normal CC: calimeroteknik, degeneracypressure, dennisfrancis.in, marc.khouzam, pedro
Priority: P2    
Version: HEAD   
Target Milestone: 7.2   
Host: Linux myhost 2.6.35-ARCH #1 SMP PREEMPT i686 Intel(R) Core(TM)2 Duo CPU T6570 @ 2.10GHz GenuineIntel GNU/Linux Target: i686-pc-linux-gnu
Build: 7.2.0.20101112 Last reconfirmed:
Attachments: Screen dump of debug procedure; Backtrace of gdb using gdb

Description Dennis Francis 2010-11-13 00:53:47 UTC
Created attachment 5120 [details]
Screen dump of debug procedure; Backtrace of gdb using gdb

Steps to reproduce
------------------
1. Start gdb
2. Load and start any arbitrary binary.
3. Issue the command 'strace' without any args
---> gdb segfaults !

As per GDB's internal doc
"""
(gdb) help strace
Set a static tracepoint at specified line, function or marker.

strace [LOCATION] [if CONDITION]
.....
.....
With no LOCATION, uses current execution address of
the selected stack frame
"""

Debug gdb using gdb
--------------------
1. Created a simple binary "trivial"
2. Started gdb 
3. load and run gdb
   3.1.  Load and start "trivial"
   3.2.  issue 'strace' command
       ....<segfaults>
4. run bt

[See the attachment for the complete screen dump]

Backtrace generated in the parent gdb after the segfault
---------------------------------------------------------

#0  0xb7cca90d in strncmp () from /lib/libc.so.6
#1  0x08109ebd in create_breakpoint (gdbarch=0x8542578, arg=0x0, cond_string=0x0, thread=0, parse_condition_and_thread=1, tempflag=0, 
    type_wanted=bp_static_tracepoint, ignore_count=0, pending_break_support=AUTO_BOOLEAN_AUTO, ops=0x0, from_tty=1, enabled=1) at breakpoint.c:7475
#2  0x0810f7cf in strace_command (arg=0x0, from_tty=1) at breakpoint.c:10908
#3  0x080c4beb in do_cfunc (c=0x8452368, args=0x0, from_tty=1) at ./cli/cli-decode.c:67
#4  0x080c72cb in cmd_func (cmd=0x8452368, args=0x0, from_tty=1) at ./cli/cli-decode.c:1771
#5  0x080578dd in execute_command (p=0x84309d6 "", from_tty=1) at top.c:422
#6  0x0816f27a in command_handler (command=0x84309d0 "strace") at event-top.c:498
#7  0x0816f7de in command_line_handler (rl=0x8511b48 "\300\241X\b(\033Q\b") at event-top.c:702
#8  0x0825992b in rl_callback_read_char () at callback.c:205
#9  0x0816e9e7 in rl_callback_read_char_wrapper (client_data=0x0) at event-top.c:178
#10 0x0816f172 in stdin_event_handler (error=0, client_data=0x0) at event-top.c:433
#11 0x0816deaa in handle_file_event (data=...) at event-loop.c:817
#12 0x0816d6ed in process_event () at event-loop.c:399
#13 0x0816d7b2 in gdb_do_one_event (data=0x0) at event-loop.c:464
#14 0x0816864a in catch_errors (func=0x816d6fb <gdb_do_one_event>, func_args=0x0, errstring=0x832968b "", mask=6) at exceptions.c:518
#15 0x080d9f48 in tui_command_loop (data=0x0) at ./tui/tui-interp.c:171
#16 0x08168d16 in current_interp_command_loop () at interps.c:291
#17 0x0804ebee in captured_command_loop (data=0x0) at ./main.c:227
#18 0x0816864a in catch_errors (func=0x804ebe3 <captured_command_loop>, func_args=0x0, errstring=0x830ac06 "", mask=6) at exceptions.c:518
#19 0x0804fa7e in captured_main (data=0xbffff480) at ./main.c:910
#20 0x0816864a in catch_errors (func=0x804ec24 <captured_main>, func_args=0xbffff480, errstring=0x830ac06 "", mask=6) at exceptions.c:518
#21 0x0804fab4 in gdb_main (args=0xbffff480) at ./main.c:919
#22 0x0804e973 in main (argc=1, argv=0xbffff544) at gdb.c:34

Looks like strncpy() dereferences the null pointer arg

I haven't tried any previous versions for the same issue.
Comment 1 Dennis Francis 2010-11-13 01:09:28 UTC
(In reply to comment #0)
>
> Looks like strncpy() dereferences the null pointer arg
> 

Correction - strncmp()   ( not strncpy() )
Comment 2 Marc Khouzam 2010-11-25 23:17:08 UTC
Fix posted at http://sourceware.org/ml/gdb-patches/2010-11/msg00438.html
I'm committing it now.
Comment 3 Marc Khouzam 2010-11-25 23:30:17 UTC
Committed fix to HEAD and 7_2
http://sourceware.org/ml/gdb-patches/2010-11/msg00440.html
Comment 4 Pedro Alves 2010-11-25 23:33:13 UTC
Thanks Marc.  Closing.
Comment 5 Pedro Alves 2010-12-18 15:39:47 UTC
*** Bug 12271 has been marked as a duplicate of this bug. ***