diff options
| author | Roland McGrath <roland@hack.frob.com> | 2015-04-17 14:29:40 -0700 |
|---|---|---|
| committer | Roland McGrath <roland@hack.frob.com> | 2015-04-17 14:29:40 -0700 |
| commit | 2bd2cad9e8a410643e80efa0b15f6f2882e1271b (patch) | |
| tree | fa939126506e51673f782d01ca439e5f6080f64d | |
| parent | 328c44c3670ebf6c1bd790acddce65a12998cd6c (diff) | |
| download | glibc-2bd2cad9e8a410643e80efa0b15f6f2882e1271b.tar.gz | |
Avoid confusing compiler with dynamically impossible statically invalid dereference in _dl_close_worker.
| -rw-r--r-- | ChangeLog | 5 | ||||
| -rw-r--r-- | elf/dl-close.c | 16 |
2 files changed, 18 insertions, 3 deletions
@@ -1,5 +1,10 @@ 2015-04-17 Roland McGrath <roland@hack.frob.com> + * elf/dl-close.c (_dl_close_worker) [DL_NNS == 1]: Just assert that + IMAP->l_prev cannot be null, and #if out the code for the contrary + case, avoiding 'assert (nsid != LM_ID_BASE)' making the compiler + believe that NS (&_dl_ns[NSID]) could point outside the array. + * elf/dl-open.c (_dl_open): Use __glibc_unlikely in invalid namespace check. Reject NSID < 0 and NSID >= dl_nns, and check for DL_NNS==1, before using NSID as an index. diff --git a/elf/dl-close.c b/elf/dl-close.c index cf8f9e0465..412f71d70b 100644 --- a/elf/dl-close.c +++ b/elf/dl-close.c @@ -641,9 +641,16 @@ _dl_close_worker (struct link_map *map) DL_UNMAP (imap); /* Finally, unlink the data structure and free it. */ - if (imap->l_prev != NULL) - imap->l_prev->l_next = imap->l_next; - else +#if DL_NNS == 1 + /* The assert in the (imap->l_prev == NULL) case gives + the compiler license to warn that NS points outside + the dl_ns array bounds in that case (as nsid != LM_ID_BASE + is tantamount to nsid >= DL_NNS). That should be impossible + in this configuration, so just assert about it instead. */ + assert (nsid == LM_ID_BASE); + assert (imap->l_prev != NULL); +#else + if (imap->l_prev == NULL) { assert (nsid != LM_ID_BASE); ns->_ns_loaded = imap->l_next; @@ -652,6 +659,9 @@ _dl_close_worker (struct link_map *map) we leave for debuggers to examine. */ r->r_map = (void *) ns->_ns_loaded; } + else +#endif + imap->l_prev->l_next = imap->l_next; --ns->_ns_nloaded; if (imap->l_next != NULL) |