Skip to content

GDB command call doesn't trigger any gdb.Event #826

@byselsec

Description

@byselsec
  • Did you use the latest version of GEF from dev branch?
  • Is your bug specific to GEF (not GDB)? - Try to reproduce it running gdb -nx
  • Did you read the documentation first?
  • Did you check issues (including
    the closed ones) - and the PR?

Step 1: Describe your environment

  • Operating System / Distribution: Gentoo Hardened 5.16.5-gentoo-x86_64
  • Architecture: x86_64
  • GEF version (including the Python library version) run version in GEF.
gef➤  version
GEF: rev:2b7f31515a3638718b133e0d3b096aedeef5518c (Git - clean)
SHA256(/var/tmp/test/gef/gef.py): 767fcae12cac4cc6dbd3a0b2f51ad6b66f40ed72be199f256ed6c85aed44a70f
GDB: 11.2
GDB-Python: 3.9

Step 2: Describe your problem

heap bins doesn't show the real state of the heap when using gdb commands like call free and call malloc. After using them,
heap bins shows wrong information.

For example. when I execute call (void*) malloc(0x10) it returns the chunk which was just in fastbin. Nevertheless, when I use heap bins after that, the chunk still show up in the output, even though the count has decreased.
That's how it looks like

Steps to reproduce

  1. Call malloc(0x10) from the binary.
  2. Call free(<chunk_from_step1>) from the binary.
  3. Use call (void*) malloc(0x10) from inside of gdb.
  4. Use heap bins and see, that tcachebins are not empty.

Minimalist test case

test.c

#include <stdlib.h>

int main(void)
{
    char *p;

    p = malloc(0x10);
    free(p);
} // it's the 9th line

gdbcommands.txt

!cc -g -o test test.c
gef config context.enable False
file ./test
b 9
run
heap bins
call (void*)malloc(0x10)
heap bins

Command line

gdb -x gdbcommands.txt

Expected results

fastbin should be emptied like in the case where we malloc-ed the same chunk from inside the binary.

Metadata

Metadata

Assignees

No one assigned

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions