Harden tls_dtor_list with pointer mangling [BZ #19018]

(cherry picked from commit f586e1328681b400078c995a0bb6ad301ef73549)

diff --git a/ChangeLog b/ChangeLog
index d0d2f56bf863f1474b3e5bb851736b9458aca914..391ffca191e22a1af60ffb272abff23d75fec616 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,10 @@
+2015-10-06  Florian Weimer  <fweimer@redhat.com>
+
+       [BZ #19018]
+       * stdlib/cxa_thread_atexit_impl.c (__cxa_thread_atexit_impl):
+       Mangle function pointer before storing it.
+       (__call_tls_dtors): Demangle function pointer before calling it.
+
 2015-10-15  Florian Weimer  <fweimer@redhat.com>
 
        [BZ #18928]

diff --git a/NEWS b/NEWS
index fa6f58d17e67e8c6c8aa493fb8e25983e3371aaa..cb503d13b01d1db12e332bfb1238fda7a20d138f 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -9,7 +9,8 @@ Version 2.22.1
 
 * The following bugs are resolved with this release:
 
-  18589, 18778, 18781, 18787, 18796, 18870, 18887, 18921, 18928, 18969.
+  18589, 18778, 18781, 18787, 18796, 18870, 18887, 18921, 18928, 18969,
+  19018.
 
 * The LD_POINTER_GUARD environment variable can no longer be used to
   disable the pointer guard feature.  It is always enabled.

diff --git a/stdlib/cxa_thread_atexit_impl.c b/stdlib/cxa_thread_atexit_impl.c
index 2d5d56a7fa9d8417a2a53da63daed269f91c8dec..5717f09e76882cbc386ef35666642936d378c4e6 100644 (file)
--- a/stdlib/cxa_thread_atexit_impl.c
+++ b/stdlib/cxa_thread_atexit_impl.c
@@ -98,6 +98,10 @@ static __thread struct link_map *lm_cache;
 int
 __cxa_thread_atexit_impl (dtor_func func, void *obj, void *dso_symbol)
 {
+#ifdef PTR_MANGLE
+  PTR_MANGLE (func);
+#endif
+
   /* Prepend.  */
   struct dtor_list *new = calloc (1, sizeof (struct dtor_list));
   new->func = func;
@@ -142,9 +146,13 @@ __call_tls_dtors (void)
   while (tls_dtor_list)
     {
       struct dtor_list *cur = tls_dtor_list;
+      dtor_func func = cur->func;
+#ifdef PTR_DEMANGLE
+      PTR_DEMANGLE (func);
+#endif
 
       tls_dtor_list = tls_dtor_list->next;
-      cur->func (cur->obj);
+      func (cur->obj);
 
       /* Ensure that the MAP dereference happens before
         l_tls_dtor_count decrement.  That way, we protect this access from a