diff options
Diffstat (limited to 'main/musl/0014-ldso-fix-the-dtv-update-logic-in-__tls_get_new.patch')
| -rw-r--r-- | main/musl/0014-ldso-fix-the-dtv-update-logic-in-__tls_get_new.patch | 34 |
1 files changed, 0 insertions, 34 deletions
diff --git a/main/musl/0014-ldso-fix-the-dtv-update-logic-in-__tls_get_new.patch b/main/musl/0014-ldso-fix-the-dtv-update-logic-in-__tls_get_new.patch deleted file mode 100644 index 852cc46732..0000000000 --- a/main/musl/0014-ldso-fix-the-dtv-update-logic-in-__tls_get_new.patch +++ /dev/null @@ -1,34 +0,0 @@ -From 12978acb3066db738c8c15121e81adbb63739876 Mon Sep 17 00:00:00 2001 -From: Szabolcs Nagy <nsz@port70.net> -Date: Thu, 26 Nov 2015 19:59:46 +0100 -Subject: [PATCH] ldso: fix the dtv update logic in __tls_get_new - -if two or more threads accessed tls in a dso that was loaded after -the threads were created, then __tls_get_new could do out-of-bound -memory access (leading to segfault). - -accidentally byte count was used instead of element count when -the new dtv pointer was computed. (dso->new_dtv is (void**).) - -it is rare that the same dso provides dtv for several threads, -the crash was not observed in practice, but possible to trigger. ---- - src/ldso/dynlink.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/src/ldso/dynlink.c b/src/ldso/dynlink.c -index 4648e9a..93e7d67 100644 ---- a/src/ldso/dynlink.c -+++ b/src/ldso/dynlink.c -@@ -1280,7 +1280,7 @@ void *__tls_get_new(size_t *v) - /* Get new DTV space from new DSO if needed */ - if (v[0] > (size_t)self->dtv[0]) { - void **newdtv = p->new_dtv + -- (v[0]+1)*sizeof(void *)*a_fetch_add(&p->new_dtv_idx,1); -+ (v[0]+1)*a_fetch_add(&p->new_dtv_idx,1); - memcpy(newdtv, self->dtv, - ((size_t)self->dtv[0]+1) * sizeof(void *)); - newdtv[0] = (void *)v[0]; --- -2.7.0 - |