diff options
| author | jilles <jilles@FreeBSD.org> | 2016-01-22 14:52:31 +0000 |
|---|---|---|
| committer | jilles <jilles@FreeBSD.org> | 2016-01-22 14:52:31 +0000 |
| commit | 459ec4483368fa4ae7b3c953a5af16a0d1b09096 (patch) | |
| tree | d88421ab67feaf6d316ac1cf7b5df3c38584a56a /lib/libc | |
| parent | 84fe0a03f69cd03b74bc95a5e689891dedd53613 (diff) | |
| download | FreeBSD-src-459ec4483368fa4ae7b3c953a5af16a0d1b09096.zip FreeBSD-src-459ec4483368fa4ae7b3c953a5af16a0d1b09096.tar.gz | |
sem: Don't free nameinfo that is still in list when open() fails.
This bug could be reproduced easily by calling sem_open() with O_CREAT |
O_EXCL on a semaphore that is already open in the process. The struct
sem_nameinfo would be freed while still in sem_list and later calls to
sem_open() or sem_close() could access freed memory.
PR: 206396
MFC after: 5 days
Diffstat (limited to 'lib/libc')
| -rw-r--r-- | lib/libc/gen/sem_new.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/lib/libc/gen/sem_new.c b/lib/libc/gen/sem_new.c index c5dc7e7..8fe027f 100644 --- a/lib/libc/gen/sem_new.c +++ b/lib/libc/gen/sem_new.c @@ -177,8 +177,10 @@ _sem_open(const char *name, int flags, ...) if (ni->name != NULL && strcmp(name, ni->name) == 0) { fd = _open(path, flags | O_RDWR | O_CLOEXEC | O_EXLOCK, mode); - if (fd == -1 || _fstat(fd, &sb) == -1) + if (fd == -1 || _fstat(fd, &sb) == -1) { + ni = NULL; goto error; + } if ((flags & (O_CREAT | O_EXCL)) == (O_CREAT | O_EXCL) || ni->dev != sb.st_dev || ni->ino != sb.st_ino) { |
