diff options
| author | Adhemerval Zanella <adhemerval.zanella@linaro.org> | 2025-03-27 12:30:48 -0300 |
|---|---|---|
| committer | Adhemerval Zanella <adhemerval.zanella@linaro.org> | 2025-04-02 18:01:55 +0000 |
| commit | c8e73a1492b01b9b0c189d6a5c53a5a697827bae (patch) | |
| tree | 50a812e61c87a41d6001a5de105ecd0fe8a7e90b /sysdeps | |
| parent | e8514ac7aaf1bd0cf791dbdac0b2584ef3c42e98 (diff) | |
| download | glibc-c8e73a1492b01b9b0c189d6a5c53a5a697827bae.tar.xz glibc-c8e73a1492b01b9b0c189d6a5c53a5a697827bae.zip | |
stdlib: Fix qsort memory leak if callback throws (BZ 32058)
If the input buffer exceeds the stack auxiliary buffer, qsort will
malloc a temporary one to call mergesort. Since C++ standard does
allow the callback comparison function to throw [1], the glibc
implementation can potentially leak memory.
The fixes uses a pthread_cleanup_combined_push and
pthread_cleanup_combined_pop, so it can work with and without
exception enables. The qsort code path that calls malloc now
requires some extra setup and a call to __pthread_cleanup_push
anmd __pthread_cleanup_pop (which should be ok since they just
setup some buffer state).
Checked on x86_64-linux-gnu.
[1] https://timsong-cpp.github.io/cppwp/n4950/alg.c.library#4
Reviewed-by: DJ Delorie <dj@redhat.com>
Diffstat (limited to 'sysdeps')
| -rw-r--r-- | sysdeps/htl/pthreadP.h | 15 | ||||
| -rw-r--r-- | sysdeps/mach/hurd/Makefile | 3 | ||||
| -rw-r--r-- | sysdeps/nptl/pthreadP.h | 8 |
3 files changed, 22 insertions, 4 deletions
diff --git a/sysdeps/htl/pthreadP.h b/sysdeps/htl/pthreadP.h index 78ef4e7674..535deeb89f 100644 --- a/sysdeps/htl/pthreadP.h +++ b/sysdeps/htl/pthreadP.h @@ -23,6 +23,7 @@ #include <pthread.h> #include <link.h> +#include <bits/cancelation.h> /* Attribute to indicate thread creation was issued from C11 thrd_create. */ #define ATTR_C11_THREAD ((void*)(uintptr_t)-1) @@ -233,4 +234,18 @@ weak_extern (__pthread_exit) _Static_assert (sizeof (type) == size, \ "sizeof (" #type ") != " #size) + /* Special cleanup macros which register cleanup both using + __pthread_cleanup_{push,pop} and using cleanup attribute. This is needed + for qsort, so that it supports both throwing exceptions from the caller + sort function callback (only cleanup attribute works there) and + cancellation of the thread running the callback if the callback or some + routines it calls don't have unwind information. + TODO: add support for cleanup routines. */ +#ifndef pthread_cleanup_combined_push +# define pthread_cleanup_combined_push __pthread_cleanup_push +#endif +#ifndef pthread_cleanup_combined_pop +# define pthread_cleanup_combined_pop __pthread_cleanup_pop +#endif + #endif /* pthreadP.h */ diff --git a/sysdeps/mach/hurd/Makefile b/sysdeps/mach/hurd/Makefile index 4b69b40065..994de00e2f 100644 --- a/sysdeps/mach/hurd/Makefile +++ b/sysdeps/mach/hurd/Makefile @@ -337,6 +337,9 @@ tests-unsupported += tst-vfprintf-width-prec-alloc endif ifeq ($(subdir),stdlib) tests-unsupported += test-bz22786 tst-strtod-overflow +# pthread_cleanup_combined_push/pthread_cleanup_combined_pop requires cleanup +# support (BZ 32058). +test-xfail-tst-qsortx7 = yes endif ifeq ($(subdir),timezone) tests-unsupported += tst-tzset diff --git a/sysdeps/nptl/pthreadP.h b/sysdeps/nptl/pthreadP.h index 2d620ed20d..8f256967e2 100644 --- a/sysdeps/nptl/pthreadP.h +++ b/sysdeps/nptl/pthreadP.h @@ -588,10 +588,10 @@ struct __pthread_cleanup_combined_frame /* Special cleanup macros which register cleanup both using __pthread_cleanup_{push,pop} and using cleanup attribute. This is needed - for pthread_once, so that it supports both throwing exceptions from the - pthread_once callback (only cleanup attribute works there) and cancellation - of the thread running the callback if the callback or some routines it - calls don't have unwind information. */ + for pthread_once and qsort, so that it supports both throwing exceptions + from the pthread_once or caller sort function callback (only cleanup + attribute works there) and cancellation of the thread running the callback + if the callback or some routines it calls don't have unwind information. */ static __always_inline void __pthread_cleanup_combined_routine (struct __pthread_cleanup_combined_frame |