Fix bad pointer / leak in regex code

[thirdparty/glibc.git] / elf / cache.c

diff --git a/elf/cache.c b/elf/cache.c
index dadab9132b0078049f09a064d19586cc03287204..d0d5858448516d4f4ed793c8fc66041439d72073 100644 (file)
--- a/elf/cache.c
+++ b/elf/cache.c
@@ -1,4 +1,4 @@
-/* Copyright (C) 1999-2003,2005,2006,2007,2011 Free Software Foundation, Inc.
+/* Copyright (C) 1999-2019 Free Software Foundation, Inc.
    This file is part of the GNU C Library.
    Contributed by Andreas Jaeger <aj@suse.de>, 1999.
 
@@ -25,6 +25,7 @@
 #include <stdlib.h>
 #include <string.h>
 #include <unistd.h>
+#include <stdint.h>
 #include <sys/fcntl.h>
 #include <sys/mman.h>
 #include <sys/stat.h>
@@ -90,6 +91,35 @@ print_entry (const char *lib, int flag, unsigned int osversion,
       break;
     case FLAG_MIPS64_LIBN64:
       fputs (",64bit", stdout);
+      break;
+    case FLAG_X8664_LIBX32:
+      fputs (",x32", stdout);
+      break;
+    case FLAG_ARM_LIBHF:
+      fputs (",hard-float", stdout);
+      break;
+    case FLAG_AARCH64_LIB64:
+      fputs (",AArch64", stdout);
+      break;
+    /* Uses the ARM soft-float ABI.  */
+    case FLAG_ARM_LIBSF:
+      fputs (",soft-float", stdout);
+      break;
+    case FLAG_MIPS_LIB32_NAN2008:
+      fputs (",nan2008", stdout);
+      break;
+    case FLAG_MIPS64_LIBN32_NAN2008:
+      fputs (",N32,nan2008", stdout);
+      break;
+    case FLAG_MIPS64_LIBN64_NAN2008:
+      fputs (",64bit,nan2008", stdout);
+      break;
+    case FLAG_RISCV_FLOAT_ABI_SOFT:
+      fputs (",soft-float", stdout);
+      break;
+    case FLAG_RISCV_FLOAT_ABI_DOUBLE:
+      fputs (",double-float", stdout);
+      break;
     case 0:
       break;
     default:
@@ -169,6 +199,11 @@ print_cache (const char *cache_name)
     }
   else
     {
+      /* Check for corruption, avoiding overflow.  */
+      if ((cache_size - sizeof (struct cache_file)) / sizeof (struct file_entry)
+         < cache->nlibs)
+       error (EXIT_FAILURE, 0, _("File is not a cache file.\n"));
+
       size_t offset = ALIGN_CACHE (sizeof (struct cache_file)
                                   + (cache->nlibs
                                      * sizeof (struct file_entry)));
@@ -176,8 +211,8 @@ print_cache (const char *cache_name)
       cache_data = (const char *) &cache->libs[cache->nlibs];
 
       /* Check for a new cache embedded in the old format.  */
-      if (cache_size >
-         (offset + sizeof (struct cache_file_new)))
+      if (cache_size
+         > (offset + sizeof (struct cache_file_new)))
        {
 
          cache_new = (struct cache_file_new *) ((void *)cache + offset);
@@ -424,8 +459,7 @@ save_cache (const char *cache_name)
        error (EXIT_FAILURE, errno, _("Writing of cache data failed"));
     }
 
-  if (write (fd, strings, total_strlen) != (ssize_t) total_strlen
-      || close (fd))
+  if (write (fd, strings, total_strlen) != (ssize_t) total_strlen)
     error (EXIT_FAILURE, errno, _("Writing of cache data failed"));
 
   /* Make sure user can always read cache file */
@@ -434,6 +468,10 @@ save_cache (const char *cache_name)
           _("Changing access rights of %s to %#o failed"), temp_name,
           S_IROTH|S_IRGRP|S_IRUSR|S_IWUSR);
 
+  /* Make sure that data is written to disk.  */
+  if (fsync (fd) != 0 || close (fd) != 0)
+    error (EXIT_FAILURE, errno, _("Writing of cache data failed"));
+
   /* Move temporary to its final location.  */
   if (rename (temp_name, cache_name))
     error (EXIT_FAILURE, errno, _("Renaming of %s to %s failed"), temp_name,
@@ -674,7 +712,9 @@ load_aux_cache (const char *aux_cache_name)
   if (aux_cache == MAP_FAILED
       || aux_cache_size < sizeof (struct aux_cache_file)
       || memcmp (aux_cache->magic, AUX_CACHEMAGIC, sizeof AUX_CACHEMAGIC - 1)
-      || aux_cache->nlibs >= aux_cache_size)
+      || aux_cache_size != (sizeof (struct aux_cache_file)
+                           + aux_cache->nlibs * sizeof (struct aux_cache_file_entry)
+                           + aux_cache->len_strings))
     {
       close (fd);
       init_aux_cache ();
@@ -786,7 +826,8 @@ save_aux_cache (const char *aux_cache_name)
 
   if (write (fd, file_entries, file_entries_size + total_strlen)
       != (ssize_t) (file_entries_size + total_strlen)
-      || close (fd))
+      || fdatasync (fd) != 0
+      || close (fd) != 0)
     {
       unlink (temp_name);
       goto out_fail;