From 42ee9ca9933fb815ce7d9098f10bad6fe38c69b4 Mon Sep 17 00:00:00 2001 From: jilles Date: Wed, 27 Jan 2016 22:56:04 +0000 Subject: MFC r294565: sem: Don't free nameinfo that is still in list when open() fails. This bug could be reproduced easily by calling sem_open() with O_CREAT | O_EXCL on a semaphore that is already open in the process. The struct sem_nameinfo would be freed while still in sem_list and later calls to sem_open() or sem_close() could access freed memory. PR: 206396 --- lib/libc/gen/sem_new.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'lib/libc') diff --git a/lib/libc/gen/sem_new.c b/lib/libc/gen/sem_new.c index 7b04ef0..243ceba 100644 --- a/lib/libc/gen/sem_new.c +++ b/lib/libc/gen/sem_new.c @@ -176,8 +176,10 @@ _sem_open(const char *name, int flags, ...) if (ni->name != NULL && strcmp(name, ni->name) == 0) { fd = _open(path, flags | O_RDWR | O_CLOEXEC | O_EXLOCK, mode); - if (fd == -1 || _fstat(fd, &sb) == -1) + if (fd == -1 || _fstat(fd, &sb) == -1) { + ni = NULL; goto error; + } if ((flags & (O_CREAT | O_EXCL)) == (O_CREAT | O_EXCL) || ni->dev != sb.st_dev || ni->ino != sb.st_ino) { -- cgit v1.1