diff options
| author | jilles <jilles@FreeBSD.org> | 2016-01-27 22:56:04 +0000 |
|---|---|---|
| committer | jilles <jilles@FreeBSD.org> | 2016-01-27 22:56:04 +0000 |
| commit | 42ee9ca9933fb815ce7d9098f10bad6fe38c69b4 (patch) | |
| tree | 6566abe70454f4bb516d4bc56029438a4af29a18 /lib | |
| parent | 3e03b75dcaf65a439918ff675adb4717c6c13c6c (diff) | |
| download | FreeBSD-src-42ee9ca9933fb815ce7d9098f10bad6fe38c69b4.zip FreeBSD-src-42ee9ca9933fb815ce7d9098f10bad6fe38c69b4.tar.gz | |
MFC r294565: sem: Don't free nameinfo that is still in list when open()
fails.
This bug could be reproduced easily by calling sem_open() with O_CREAT |
O_EXCL on a semaphore that is already open in the process. The struct
sem_nameinfo would be freed while still in sem_list and later calls to
sem_open() or sem_close() could access freed memory.
PR: 206396
Diffstat (limited to 'lib')
| -rw-r--r-- | lib/libc/gen/sem_new.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/lib/libc/gen/sem_new.c b/lib/libc/gen/sem_new.c index 7b04ef0..243ceba 100644 --- a/lib/libc/gen/sem_new.c +++ b/lib/libc/gen/sem_new.c @@ -176,8 +176,10 @@ _sem_open(const char *name, int flags, ...) if (ni->name != NULL && strcmp(name, ni->name) == 0) { fd = _open(path, flags | O_RDWR | O_CLOEXEC | O_EXLOCK, mode); - if (fd == -1 || _fstat(fd, &sb) == -1) + if (fd == -1 || _fstat(fd, &sb) == -1) { + ni = NULL; goto error; + } if ((flags & (O_CREAT | O_EXCL)) == (O_CREAT | O_EXCL) || ni->dev != sb.st_dev || ni->ino != sb.st_ino) { |
