From: Martin Sebor <msebor@gmail.com>
To: libc-alpha@sourceware.org
Subject: [PATCH] avoid -Wuse-after-free [BZ #26779]
Date: Sat, 15 Jan 2022 17:21:19 -0700 [thread overview]
Message-ID: <c9f4a1b4-193e-986c-bc21-5866b9e62e16@gmail.com> (raw)
[-- Attachment #1: Type: text/plain, Size: 757 bytes --]
GCC 12 features a couple of new warnings designed to detect uses
of pointers made invalid by the pointees lifetimes having ended.
Building Glibc with the enhanced GCC exposes a few such uses,
mostly after successful calls to realloc. The attached patch
avoids the new warnings by converting the pointers to uintptr_t
first and using the converted integers instead.
The patch suppresses all instances of the warning at the strictest
setting (-Wuse-after-free=3), which includes even uses in equality
expressions. The default setting approved for GCC 12 is
-Wuse-after-free=2, which doesn't warn on such uses to accommodate
the pointer-adjustment-after-realloc idiom. At the default setting,
the changes to ldconfig.c and setenv are not necessary.
Martin
[-- Attachment #2: glibc-26779.diff --]
[-- Type: text/x-patch, Size: 3316 bytes --]
diff --git a/elf/ldconfig.c b/elf/ldconfig.c
index d14633f5ec..57bb95ebc3 100644
--- a/elf/ldconfig.c
+++ b/elf/ldconfig.c
@@ -735,9 +735,9 @@ manual_link (char *library)
create_links (real_path, path, libname, soname);
free (soname);
out:
- free (path);
if (path != real_path)
free (real_path);
+ free (path);
}
diff --git a/intl/localealias.c b/intl/localealias.c
index 3ae360f40d..e581ee4346 100644
--- a/intl/localealias.c
+++ b/intl/localealias.c
@@ -318,7 +318,9 @@ read_alias_file (const char *fname, int fname_len)
if (string_space_act + alias_len + value_len > string_space_max)
{
- /* Increase size of memory pool. */
+ /* Increase size of memory pool. Avoid using the raw
+ reallocated pointer to avoid GCC -Wuse-after-free. */
+ intptr_t ip_string_space = (intptr_t)string_space;
size_t new_size = (string_space_max
+ (alias_len + value_len > 1024
? alias_len + value_len : 1024));
@@ -326,14 +328,16 @@ read_alias_file (const char *fname, int fname_len)
if (new_pool == NULL)
goto out;
- if (__builtin_expect (string_space != new_pool, 0))
+ intptr_t ip_new_pool = (intptr_t)new_pool;
+ intptr_t ptr_diff = ip_new_pool - ip_string_space;
+ if (__builtin_expect (ptr_diff == 0, 0))
{
size_t i;
for (i = 0; i < nmap; i++)
{
- map[i].alias += new_pool - string_space;
- map[i].value += new_pool - string_space;
+ map[i].alias += ptr_diff;
+ map[i].value += ptr_diff;
}
}
diff --git a/io/ftw.c b/io/ftw.c
index 2742541f36..08ccbdd523 100644
--- a/io/ftw.c
+++ b/io/ftw.c
@@ -323,8 +323,8 @@ open_dir_stream (int *dfdp, struct ftw_data *data, struct dir_data *dirp)
buf[actsize++] = '\0';
/* Shrink the buffer to what we actually need. */
- data->dirstreams[data->actdir]->content = realloc (buf, actsize);
- if (data->dirstreams[data->actdir]->content == NULL)
+ void *content = realloc (buf, actsize);
+ if (content == NULL)
{
int save_err = errno;
free (buf);
@@ -338,6 +338,7 @@ open_dir_stream (int *dfdp, struct ftw_data *data, struct dir_data *dirp)
data->dirstreams[data->actdir]->streamfd = -1;
data->dirstreams[data->actdir] = NULL;
}
+ data->dirstreams[data->actdir]->content = content;
}
}
diff --git a/stdlib/setenv.c b/stdlib/setenv.c
index c3d2cee7b6..2176cbac31 100644
--- a/stdlib/setenv.c
+++ b/stdlib/setenv.c
@@ -150,7 +150,9 @@ __add_to_environ (const char *name, const char *value, const char *combined,
{
char **new_environ;
- /* We allocated this space; we can extend it. */
+ /* We allocated this space; we can extend it. Avoid using the raw
+ reallocated pointer to avoid GCC -Wuse-after-free. */
+ uintptr_t ip_last_environ = (uintptr_t)last_environ;
new_environ = (char **) realloc (last_environ,
(size + 2) * sizeof (char *));
if (new_environ == NULL)
@@ -159,7 +161,7 @@ __add_to_environ (const char *name, const char *value, const char *combined,
return -1;
}
- if (__environ != last_environ)
+ if ((uintptr_t)__environ != ip_last_environ)
memcpy ((char *) new_environ, (char *) __environ,
size * sizeof (char *));
next reply other threads:[~2022-01-16 0:21 UTC|newest]
Thread overview: 32+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-01-16 0:21 Martin Sebor [this message]
2022-01-16 2:25 ` Paul Eggert
2022-01-21 23:14 ` Martin Sebor
2022-01-22 0:42 ` Paul Eggert
2022-01-25 0:42 ` Martin Sebor
2022-01-25 1:08 ` Jeff Law
2022-01-18 9:48 ` Florian Weimer
2022-01-20 21:50 ` Martin Sebor
2022-01-25 0:52 ` [PATCH v2 0/5] " Martin Sebor
2022-01-25 0:57 ` [PATCH v2 1/5] " Martin Sebor
2022-01-25 17:46 ` Carlos O'Donell
2022-01-25 0:58 ` [PATCH v2 2/5] " Martin Sebor
2022-01-25 17:46 ` Carlos O'Donell
2022-01-25 0:58 ` [PATCH v2 3/5] " Martin Sebor
2022-01-25 17:47 ` Carlos O'Donell
2022-01-25 0:58 ` [PATCH v2 4/5] " Martin Sebor
2022-01-25 17:49 ` Carlos O'Donell
2022-01-25 17:51 ` Carlos O'Donell
2022-01-25 21:47 ` Florian Weimer
2022-01-26 13:55 ` Carlos O'Donell
2022-01-25 0:58 ` [PATCH v2 5/5] " Martin Sebor
2022-01-25 17:49 ` Carlos O'Donell
2022-01-25 22:50 ` [PATCH v3 " Martin Sebor
2022-01-26 14:56 ` Carlos O'Donell
2022-01-28 13:10 ` Joseph Myers
2022-01-28 17:33 ` Carlos O'Donell
2022-01-28 17:51 ` Joseph Myers
2022-01-28 23:21 ` Jeff Law
2022-01-31 15:12 ` Carlos O'Donell
2022-02-04 20:40 ` Joseph Myers
2022-01-25 17:46 ` [PATCH v2 0/5] " Carlos O'Donell
2022-01-26 3:08 ` Martin Sebor
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=c9f4a1b4-193e-986c-bc21-5866b9e62e16@gmail.com \
--to=msebor@gmail.com \
--cc=libc-alpha@sourceware.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).