[Bug libc/11200] New: loadlocale.c:_nl_load_locale() incorrectly handles mmap() failures

[Bug libc/11200] New: loadlocale.c:_nl_load_locale() incorrectly handles mmap() failures

[jlanders at vmware dot com]

The function _nl_load_locale() uses the local variable "filedata" to hold data
mmap()'d from the file specified in the argument list.

When mmap() fails in _nl_load_locale() at loadlocale.c:223, the local variable
filedata gets set to MAP_FAILED or ((void *) -1). When this failure is due to a
genuine resource issue, errno gets set to a value other than ENOSYS and the
block of code malloc()'ing space for filedata never gets executed.

Below in this same function at loadlocale.c:261, filedata is only checked
against NULL. As a result, _nl_intern_locale_data() gets passed filedata with a
value of -1. This causes applications to generate a SIGFPE exception at the
start of _nl_intern_locale_data().

The easiest fix is set filedata to NULL when mmap() fails in _nl_load_locale().

--- a/locale/loadlocale.c       2009-12-08 12:10:20.000000000 -0800
+++ b/locale/loadlocale.c       2010-01-20 12:37:06.000000000 -0800
@@ -224,6 +224,7 @@
                     PROT_READ, MAP_FILE|MAP_COPY, fd, 0);
   if (__builtin_expect (filedata == MAP_FAILED, 0))
     {
+      filedata = NULL;
       if (__builtin_expect (errno, ENOSYS) == ENOSYS)
        {
 #endif /* _POSIX_MAPPED_FILES */

This issue exists in other releases prior to glibc-2.11, including glibc-2.5 on
RHEL 5.3.

Thanks,

Joe

-- 
           Summary: loadlocale.c:_nl_load_locale() incorrectly handles
                    mmap() failures
           Product: glibc
           Version: 2.11
            Status: NEW
          Severity: normal
          Priority: P2
         Component: libc
        AssignedTo: drepper at redhat dot com
        ReportedBy: jlanders at vmware dot com
                CC: glibc-bugs at sources dot redhat dot com
 GCC build triplet: x86_64-linuxnptl
  GCC host triplet: x86_64-linuxnptl
GCC target triplet: x86_64-linuxnptl


http://sourceware.org/bugzilla/show_bug.cgi?id=11200

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.

[Bug libc/11200] loadlocale.c:_nl_load_locale() incorrectly handles mmap() failures

[jlanders at vmware dot com]

------- Additional Comments From jlanders at vmware dot com  2010-01-21 03:45 -------
Created an attachment (id=4545)
 --> (http://sourceware.org/bugzilla/attachment.cgi?id=4545&action=view)
Proposed patch

Attached proposed patch.

-- 


http://sourceware.org/bugzilla/show_bug.cgi?id=11200

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.

[Bug libc/11200] loadlocale.c:_nl_load_locale() incorrectly handles mmap() failures

[drepper at redhat dot com]

------- Additional Comments From drepper at redhat dot com  2010-01-22 20:46 -------
Checked into git.

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|                            |FIXED


http://sourceware.org/bugzilla/show_bug.cgi?id=11200

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.

[Bug libc/11200] loadlocale.c:_nl_load_locale() incorrectly handles mmap() failures

[ianw at vmware dot com]

------- Additional Comments From ianw at vmware dot com  2010-01-22 21:12 -------
*** Bug 11181 has been marked as a duplicate of this bug. ***

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |ianw at vmware dot com


http://sourceware.org/bugzilla/show_bug.cgi?id=11200

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.

[Bug libc/11200] loadlocale.c:_nl_load_locale() incorrectly handles mmap() failures

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=11200

Florian Weimer <fweimer at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
              Flags|                            |security-

-- 
You are receiving this mail because:
You are on the CC list for the bug.