Print this page
3953 Calling ::list without specifying the name of the next member causes mdb to core dump
Reviewed by: Christopher Siden <christopher.siden@delphix.com>
Reviewed by: Matthew Ahrens <mahrens@delphix.com>

Split Close
Expand all
Collapse all
          --- old/usr/src/cmd/mdb/common/mdb/mdb_print.c
          +++ new/usr/src/cmd/mdb/common/mdb/mdb_print.c
↓ open down ↓ 16 lines elided ↑ open up ↑
  17   17   * information: Portions Copyright [yyyy] [name of copyright owner]
  18   18   *
  19   19   * CDDL HEADER END
  20   20   */
  21   21  /*
  22   22   * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  23   23   * Use is subject to license terms.
  24   24   */
  25   25  
  26   26  /*
  27      - * Copyright (c) 2012 by Delphix. All rights reserved.
       27 + * Copyright (c) 2013 by Delphix. All rights reserved.
  28   28   * Copyright (c) 2012 Joyent, Inc. All rights reserved.
  29   29   */
  30   30  
  31   31  #include <mdb/mdb_modapi.h>
  32   32  #include <mdb/mdb_target.h>
  33   33  #include <mdb/mdb_argvec.h>
  34   34  #include <mdb/mdb_string.h>
  35   35  #include <mdb/mdb_stdlib.h>
  36   36  #include <mdb/mdb_err.h>
  37   37  #include <mdb/mdb_debug.h>
↓ open down ↓ 662 lines elided ↑ open up ↑
 700  700          int offset;
 701  701          uintptr_t a, tmp;
 702  702          int ret;
 703  703  
 704  704          if (!(flags & DCMD_ADDRSPEC) || argc == 0)
 705  705                  return (DCMD_USAGE);
 706  706  
 707  707          if (argv->a_type != MDB_TYPE_STRING) {
 708  708                  /*
 709  709                   * We are being given a raw offset in lieu of a type and
 710      -                 * member; confirm the arguments.
      710 +                 * member; confirm the number of arguments and argument
      711 +                 * type.
 711  712                   */
 712      -                if (argv->a_type != MDB_TYPE_IMMEDIATE)
      713 +                if (argc != 1 || argv->a_type != MDB_TYPE_IMMEDIATE)
 713  714                          return (DCMD_USAGE);
 714  715  
 715  716                  offset = argv->a_un.a_val;
 716  717  
 717  718                  argv++;
 718  719                  argc--;
 719  720  
 720  721                  if (offset % sizeof (uintptr_t)) {
 721  722                          mdb_warn("offset must fall on a word boundary\n");
 722  723                          return (DCMD_ABORT);
 723  724                  }
 724  725          } else {
 725  726                  const char *member;
 726  727                  char buf[MDB_SYM_NAMLEN];
 727  728                  int ret;
 728  729  
      730 +                /*
      731 +                 * Check that we were provided 2 arguments: a type name
      732 +                 * and a member of that type.
      733 +                 */
      734 +                if (argc != 2)
      735 +                        return (DCMD_USAGE);
      736 +
 729  737                  ret = args_to_typename(&argc, &argv, buf, sizeof (buf));
 730  738                  if (ret != 0)
 731  739                          return (ret);
 732  740  
 733  741                  argv++;
 734  742                  argc--;
 735  743  
 736  744                  member = argv->a_un.a_str;
 737  745                  offset = mdb_ctf_offsetof_by_name(buf, member);
 738  746                  if (offset == -1)
↓ open down ↓ 2346 lines elided ↑ open up ↑
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX