RepoMirrors/musl
1
0
Fork 0
mirror of git://git.musl-libc.org/musl synced 2025-01-19 05:10:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix invalid-/double-/use-after-free in new dlopen ctor execution

Browse Source 
this affected the error path where dlopen successfully found and
loaded the requested dso and all its dependencies, but failed to
resolve one or more relocations, causing the operation to fail after
storage for the ctor queue was allocated.

commit 188759bbee wrongly put the free
for the ctor_queue array in the error path inside a loop over each
loaded dso that needed to be backed-out, rather than just doing it
once. in addition, the exit path also observed the ctor_queue pointer
still being nonzero, and would attempt to call ctors on the backed-out
dsos unless the double-free crashed the process first.
This commit is contained in:
Rich Felker 2019-03-10 13:16:59 -04:00
parent 4918b7fb0d
commit 50cd02386b
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
ldso/dynlink.c
View File

@ -2000,8 +2000,9 @@ void *dlopen(const char *file, int mode)
free(p->deps);
unmap_library(p);
free(p);
free(ctor_queue);
}
free(ctor_queue);
ctor_queue = 0;
if (!orig_tls_tail) libc.tls_head = 0;
tls_tail = orig_tls_tail;
if (tls_tail) tls_tail->next = 0;