Rich Felker
3e936ce81b
commit 5345c9b884 added a linked list to
track the FILE streams currently locked (via flockfile) by a thread.
due to a failure to fully link newly added members, removal from the
list could leave behind references which could later result in writes
to already-freed memory and possibly other memory corruption.
implicit stdio locking was unaffected; the list is only used in
conjunction with explicit flockfile locking.
this bug was not present in any releases; it was introduced and fixed
during the same release cycle.
patch by Timo Teräs, who discovered and tracked down the bug.
41 lines
908 B
C
41 lines
908 B
C
#include "stdio_impl.h"
|
|
#include "pthread_impl.h"
|
|
#include <limits.h>
|
|
|
|
void __do_orphaned_stdio_locks()
|
|
{
|
|
FILE *f;
|
|
for (f=__pthread_self()->stdio_locks; f; f=f->next_locked)
|
|
a_store(&f->lock, 0x40000000);
|
|
}
|
|
|
|
void __unlist_locked_file(FILE *f)
|
|
{
|
|
if (f->lockcount) {
|
|
if (f->next_locked) f->next_locked->prev_locked = f->prev_locked;
|
|
if (f->prev_locked) f->prev_locked->next_locked = f->next_locked;
|
|
else __pthread_self()->stdio_locks = f->next_locked;
|
|
}
|
|
}
|
|
|
|
int ftrylockfile(FILE *f)
|
|
{
|
|
pthread_t self = __pthread_self();
|
|
int tid = self->tid;
|
|
if (f->lock == tid) {
|
|
if (f->lockcount == LONG_MAX)
|
|
return -1;
|
|
f->lockcount++;
|
|
return 0;
|
|
}
|
|
if (f->lock < 0) f->lock = 0;
|
|
if (f->lock || a_cas(&f->lock, 0, tid))
|
|
return -1;
|
|
f->lockcount = 1;
|
|
f->prev_locked = 0;
|
|
f->next_locked = self->stdio_locks;
|
|
if (f->next_locked) f->next_locked->prev_locked = f;
|
|
self->stdio_locks = f;
|
|
return 0;
|
|
}
|