[Bug nptl/18524] New: Missing calloc error checking in __cxa_thread_atexit_impl

[Bug nptl/18524] New: Missing calloc error checking in __cxa_thread_atexit_impl

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=18524

            Bug ID: 18524
           Summary: Missing calloc error checking in
                    __cxa_thread_atexit_impl
           Product: glibc
           Version: 2.21
            Status: NEW
          Severity: normal
          Priority: P2
         Component: nptl
          Assignee: unassigned at sourceware dot org
          Reporter: fweimer at redhat dot com
                CC: drepper.fsp at gmail dot com
  Target Milestone: ---
             Flags: security-

This should have an explicit check for calloc failure:

  struct dtor_list *new = calloc (1, sizeof (struct dtor_list));
  new->func = func;
  new->obj = obj;

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug nptl/18524] Missing calloc error checking in __cxa_thread_atexit_impl

[neleai at seznam dot cz]

https://sourceware.org/bugzilla/show_bug.cgi?id=18524

Ondrej Bilka <neleai at seznam dot cz> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |neleai at seznam dot cz

--- Comment #1 from Ondrej Bilka <neleai at seznam dot cz> ---
Do you have patch for that. Only course of action is return which causes memory
leak as you don't call destructor later.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug nptl/18524] Missing calloc error checking in __cxa_thread_atexit_impl

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=18524

--- Comment #2 from Florian Weimer <fweimer at redhat dot com> ---
(In reply to Ondrej Bilka from comment #1)
> Do you have patch for that. Only course of action is return which causes
> memory leak as you don't call destructor later.

I think the interface cannot be salvaged.  The required space for bookkeeping
needs to be allocated in .tbss, or separately, at the time .tbss is allocated. 
I don't think anything in the standard permits leaks or exceptions in this
context.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug nptl/18524] Missing calloc error checking in __cxa_thread_atexit_impl

[carlos at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=18524

Carlos O'Donell <carlos at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |carlos at redhat dot com

--- Comment #3 from Carlos O'Donell <carlos at redhat dot com> ---
(In reply to Florian Weimer from comment #2)
> (In reply to Ondrej Bilka from comment #1)
> > Do you have patch for that. Only course of action is return which causes
> > memory leak as you don't call destructor later.
> 
> I think the interface cannot be salvaged.  The required space for
> bookkeeping needs to be allocated in .tbss, or separately, at the time .tbss
> is allocated.  I don't think anything in the standard permits leaks or
> exceptions in this context.

So argue QoI, and just abort if calloc returns null? It's a crappy solution,
but it prevents the program from running into undefined territory by not
running destructors.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug nptl/18524] Missing calloc error checking in __cxa_thread_atexit_impl

[tavianator at tavianator dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=18524

Tavian Barnes <tavianator at tavianator dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |tavianator at tavianator dot com

--- Comment #4 from Tavian Barnes <tavianator at tavianator dot com> ---
Any chance this can get fixed?  I'm running into it while trying to test that
my own applications handle memory allocation failures correctly.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug nptl/18524] Missing calloc error checking in __cxa_thread_atexit_impl

[siddhesh at sourceware dot org]

https://sourceware.org/bugzilla/show_bug.cgi?id=18524

Siddhesh Poyarekar <siddhesh at sourceware dot org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |FIXED
   Target Milestone|---                         |2.34
                 CC|                            |siddhesh at sourceware dot org

--- Comment #5 from Siddhesh Poyarekar <siddhesh at sourceware dot org> ---
commit 4aedc25f55eda50010f2932fdb0a533db6f89f61 (HEAD -> master, origin/master,
Author: Siddhesh Poyarekar <siddhesh@sourceware.org>
Date:   Wed Jul 28 13:11:20 2021 +0530

    __cxa_thread_atexit_impl: Abort on allocation failure [BZ #18524]

    Abort in the unlikely event that allocation fails when trying to
    register a TLS destructor.

    Reviewed-by: Florian Weimer <fweimer@redhat.com>

-- 
You are receiving this mail because:
You are on the CC list for the bug.