37 lines
1.1 KiB
Diff
37 lines
1.1 KiB
Diff
commit f586e1328681b400078c995a0bb6ad301ef73549
|
|
Author: Florian Weimer <fweimer@redhat.com>
|
|
Date: Tue Oct 6 13:12:36 2015 +0200
|
|
|
|
Harden tls_dtor_list with pointer mangling [BZ #19018]
|
|
|
|
diff --git a/stdlib/cxa_thread_atexit_impl.c b/stdlib/cxa_thread_atexit_impl.c
|
|
index 2d5d56a..5717f09 100644
|
|
--- a/stdlib/cxa_thread_atexit_impl.c
|
|
+++ b/stdlib/cxa_thread_atexit_impl.c
|
|
@@ -98,6 +98,10 @@ static __thread struct link_map *lm_cache;
|
|
int
|
|
__cxa_thread_atexit_impl (dtor_func func, void *obj, void *dso_symbol)
|
|
{
|
|
+#ifdef PTR_MANGLE
|
|
+ PTR_MANGLE (func);
|
|
+#endif
|
|
+
|
|
/* Prepend. */
|
|
struct dtor_list *new = calloc (1, sizeof (struct dtor_list));
|
|
new->func = func;
|
|
@@ -142,9 +146,13 @@ __call_tls_dtors (void)
|
|
while (tls_dtor_list)
|
|
{
|
|
struct dtor_list *cur = tls_dtor_list;
|
|
+ dtor_func func = cur->func;
|
|
+#ifdef PTR_DEMANGLE
|
|
+ PTR_DEMANGLE (func);
|
|
+#endif
|
|
|
|
tls_dtor_list = tls_dtor_list->next;
|
|
- cur->func (cur->obj);
|
|
+ func (cur->obj);
|
|
|
|
/* Ensure that the MAP dereference happens before
|
|
l_tls_dtor_count decrement. That way, we protect this access from a
|