[Bug libgomp/111413] New: libgomp >= 13 segfault on loading if environ is NULL

[Bug libgomp/111413] New: libgomp >= 13 segfault on loading if environ is NULL

[silvio at traversaro dot it]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111413

            Bug ID: 111413
           Summary: libgomp >= 13 segfault on loading if environ is NULL
           Product: gcc
           Version: og13 (devel/omp/gcc-13)
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: libgomp
          Assignee: unassigned at gcc dot gnu.org
          Reporter: silvio at traversaro dot it
                CC: jakub at gcc dot gnu.org
  Target Milestone: ---

Created attachment 55900
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=55900&action=edit
Example to reproduce the issue, compile with gcc -ldl test_gomp_segfault.c -o
test_gomp_segfault

Since release 13, it seems that libgomp fails on loading in the environ global
variable is NULL, for example if clearenv
(https://man7.org/linux/man-pages/man3/clearenv.3.html) was called before a
dlopen.

The problem seems in
https://gcc.gnu.org/git/?p=gcc.git;a=blob;f=libgomp/env.c;hb=73a0d3bf895b5c322676178a51ac0d68cf603953#l2227,
where `environ` is dereferenced without first checking if it is NULL.

A minimal reproducer is attached to the issue, that can be compiled and run as:

gcc -ldl test_gomp_segfault.c -o test_gomp_segfault
./test_gomp_segfault

[Bug libgomp/111413] libgomp >= 13 segfault on loading if environ is NULL

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111413

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
             Status|UNCONFIRMED                 |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |jakub at gcc dot gnu.org
   Last reconfirmed|                            |2023-09-18

--- Comment #1 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Created attachment 55920
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=55920&action=edit
gcc14-pr111413.patch

Untested fix.  Large patch but in the end it is just
--- libgomp/env.c
+++ libgomp/env.c
@@ -2224,6 +2224,7 @@ initialize_env (void)
   none = gomp_get_initial_icv_item (GOMP_DEVICE_NUM_FOR_NO_SUFFIX);
   initialize_icvs (&none->icvs);

+  if (environ)
     for (env = environ; *env != 0; env++)
       {
        if (!startswith (*env, "OMP_"))
plus reindentation.

[Bug libgomp/111413] libgomp >= 13 segfault on loading if environ is NULL

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111413

--- Comment #2 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Jakub Jelinek <jakub@gcc.gnu.org>:

https://gcc.gnu.org/g:15345980633c502f0486a2e40e96224f49134130

commit r14-4122-g15345980633c502f0486a2e40e96224f49134130
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Tue Sep 19 09:26:35 2023 +0200

    libgomp: Handle NULL environ like pointer to NULL pointer [PR111413]

    clearenv function just sets environ to NULL (after sometimes freeing it),
    rather than setting it to a pointer to NULL, and our code was assuming
    it is always non-NULL.

    Fixed thusly, the change seems to be large but actually is just
    +  if (environ)
         for (env = environ; *env != 0; env++)
    plus reindentation.  I've also noticed the block after this for loop
    was badly indented (too much) and fixed that too.

    No testcase added, as it needs clearenv + dlopen.

    2023-09-19  Jakub Jelinek  <jakub@redhat.com>

            PR libgomp/111413
            * env.c (initialize_env): Don't dereference environ if it is NULL.
            Reindent.

[Bug libgomp/111413] libgomp >= 13 segfault on loading if environ is NULL

[silvio at traversaro dot it]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111413

--- Comment #3 from Silvio Traversaro <silvio at traversaro dot it> ---
Thanks a lot for fixing this!

[Bug libgomp/111413] libgomp >= 13 segfault on loading if environ is NULL

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111413

--- Comment #4 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-13 branch has been updated by Jakub Jelinek
<jakub@gcc.gnu.org>:

https://gcc.gnu.org/g:c128ad8e830e90a429eaeccc3fb000a73fd6779c

commit r13-8118-gc128ad8e830e90a429eaeccc3fb000a73fd6779c
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Tue Sep 19 09:26:35 2023 +0200

    libgomp: Handle NULL environ like pointer to NULL pointer [PR111413]

    clearenv function just sets environ to NULL (after sometimes freeing it),
    rather than setting it to a pointer to NULL, and our code was assuming
    it is always non-NULL.

    Fixed thusly, the change seems to be large but actually is just
    +  if (environ)
         for (env = environ; *env != 0; env++)
    plus reindentation.  I've also noticed the block after this for loop
    was badly indented (too much) and fixed that too.

    No testcase added, as it needs clearenv + dlopen.

    2023-09-19  Jakub Jelinek  <jakub@redhat.com>

            PR libgomp/111413
            * env.c (initialize_env): Don't dereference environ if it is NULL.
            Reindent.

    (cherry picked from commit 15345980633c502f0486a2e40e96224f49134130)