picnoir/glibc
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

Harden tls_dtor_list with pointer mangling [BZ #19018]

Browse source
This commit is contained in:
Florian Weimer 2015-10-06 13:12:36 +02:00
parent be64c2ef2a
commit f586e13286
3 changed files with 18 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
ChangeLog
View file

@ -1,3 +1,10 @@
2015-10-06 Florian Weimer <fweimer@redhat.com>
[BZ #19018]
* stdlib/cxa_thread_atexit_impl.c (__cxa_thread_atexit_impl):
Mangle function pointer before storing it.
(__call_tls_dtors): Demangle function pointer before calling it.
2015-10-05 Paul Pluzhnikov <ppluzhnikov@google.com>
[BZ #19012]

4
NEWS
View file

@ -17,8 +17,8 @@ Version 2.23
18757, 18778, 18781, 18787, 18789, 18790, 18795, 18796, 18803, 18820,
18823, 18824, 18825, 18857, 18863, 18870, 18872, 18873, 18875, 18887,
18921, 18951, 18952, 18956, 18961, 18966, 18967, 18969, 18970, 18977,
18980, 18981, 18985, 19003, 19012, 19016, 19032, 19046, 19049, 19050,
19059, 19071.
18980, 18981, 18985, 19003, 19012, 19016, 19018, 19032, 19046, 19049,
19050, 19059, 19071.
* The obsolete header <regexp.h> has been removed. Programs that require
this header must be updated to use <regex.h> instead.

10
stdlib/cxa_thread_atexit_impl.c
View file

@ -98,6 +98,10 @@ static __thread struct link_map *lm_cache;
int
__cxa_thread_atexit_impl (dtor_func func, void *obj, void *dso_symbol)
{
#ifdef PTR_MANGLE
PTR_MANGLE (func);
#endif
/* Prepend. */
struct dtor_list *new = calloc (1, sizeof (struct dtor_list));
new->func = func;
@ -142,9 +146,13 @@ __call_tls_dtors (void)
while (tls_dtor_list)
{
struct dtor_list *cur = tls_dtor_list;
dtor_func func = cur->func;
#ifdef PTR_DEMANGLE
PTR_DEMANGLE (func);
#endif
tls_dtor_list = tls_dtor_list->next;
cur->func (cur->obj);
func (cur->obj);
/* Ensure that the MAP dereference happens before
l_tls_dtor_count decrement. That way, we protect this access from a