]> git.ipfire.org Git - thirdparty/glibc.git/commit
librt: fix NULL pointer dereference (bug 28213)
authorNikita Popov <npv1310@gmail.com>
Mon, 9 Aug 2021 14:47:34 +0000 (20:17 +0530)
committerSiddhesh Poyarekar <siddhesh@sourceware.org>
Tue, 17 Aug 2021 13:32:38 +0000 (19:02 +0530)
commit76dfec932475fa1a8751149520fa39bc4bbc9125
treec14b8e77f206b3f31dee1229da6556ab7cdcb4cd
parent737efa27fca5c97f566a2005687fda7d6659cd2e
librt: fix NULL pointer dereference (bug 28213)

Helper thread frees copied attribute on NOTIFY_REMOVED message
received from the OS kernel.  Unfortunately, it fails to check whether
copied attribute actually exists (data.attr != NULL).  This worked
earlier because free() checks passed pointer before actually
attempting to release corresponding memory.  But
__pthread_attr_destroy assumes pointer is not NULL.

So passing NULL pointer to __pthread_attr_destroy will result in
segmentation fault.  This scenario is possible if
notification->sigev_notify_attributes == NULL (which means default
thread attributes should be used).

Signed-off-by: Nikita Popov <npv1310@gmail.com>
Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
(cherry picked from commit b805aebd42364fe696e417808a700fdb9800c9e8)
sysdeps/unix/sysv/linux/mq_notify.c