Harden tls_dtor_list with pointer mangling [BZ #19018]

diff --git a/ChangeLog b/ChangeLog
index 259b05e692c9b78612ad212f7d42b48415355a33..f482f689c664a31e13a92ec14237a6ab5cb5a048 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,10 @@
+2015-10-06  Florian Weimer  <fweimer@redhat.com>
+
+       [BZ #19018]
+       * stdlib/cxa_thread_atexit_impl.c (__cxa_thread_atexit_impl):
+       Mangle function pointer before storing it.
+       (__call_tls_dtors): Demangle function pointer before calling it.
+
 2015-10-05  Paul Pluzhnikov  <ppluzhnikov@google.com>
 
        [BZ #19012]

diff --git a/NEWS b/NEWS
index 16f5cfb00288d286a8fddb05cbfbb7e40d5c06a1..0f3f33f85430a0f77021b38e1f873db28f574f6c 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -17,8 +17,8 @@ Version 2.23
   18757, 18778, 18781, 18787, 18789, 18790, 18795, 18796, 18803, 18820,
   18823, 18824, 18825, 18857, 18863, 18870, 18872, 18873, 18875, 18887,
   18921, 18951, 18952, 18956, 18961, 18966, 18967, 18969, 18970, 18977,
-  18980, 18981, 18985, 19003, 19012, 19016, 19032, 19046, 19049, 19050,
-  19059, 19071.
+  18980, 18981, 18985, 19003, 19012, 19016, 19018, 19032, 19046, 19049,
+  19050, 19059, 19071.
 
 * The obsolete header <regexp.h> has been removed.  Programs that require
   this header must be updated to use <regex.h> instead.

diff --git a/stdlib/cxa_thread_atexit_impl.c b/stdlib/cxa_thread_atexit_impl.c
index 2d5d56a7fa9d8417a2a53da63daed269f91c8dec..5717f09e76882cbc386ef35666642936d378c4e6 100644 (file)
--- a/stdlib/cxa_thread_atexit_impl.c
+++ b/stdlib/cxa_thread_atexit_impl.c
@@ -98,6 +98,10 @@ static __thread struct link_map *lm_cache;
 int
 __cxa_thread_atexit_impl (dtor_func func, void *obj, void *dso_symbol)
 {
+#ifdef PTR_MANGLE
+  PTR_MANGLE (func);
+#endif
+
   /* Prepend.  */
   struct dtor_list *new = calloc (1, sizeof (struct dtor_list));
   new->func = func;
@@ -142,9 +146,13 @@ __call_tls_dtors (void)
   while (tls_dtor_list)
     {
       struct dtor_list *cur = tls_dtor_list;
+      dtor_func func = cur->func;
+#ifdef PTR_DEMANGLE
+      PTR_DEMANGLE (func);
+#endif
 
       tls_dtor_list = tls_dtor_list->next;
-      cur->func (cur->obj);
+      func (cur->obj);
 
       /* Ensure that the MAP dereference happens before
         l_tls_dtor_count decrement.  That way, we protect this access from a