* [PATCH] Fix malloc after clearenv
@ 2002-12-26 16:09 Jakub Jelinek
2002-12-26 16:36 ` Roland McGrath
0 siblings, 1 reply; 2+ messages in thread
From: Jakub Jelinek @ 2002-12-26 16:09 UTC (permalink / raw)
To: Roland McGrath, Ulrich Drepper; +Cc: Glibc hackers
Hi!
Doing clearenv() before first malloc results in segfault (next_env_entry
is called with &runp where runp == NULL, and dereferences the NULL pointer:
char **current = *position; ... while (*current != NULL)).
The patch below is mainly just indentation adjustement, with diff -upb
it is a one-liner, adding if (__builtin_expect (_environ != NULL, 1)).
2002-12-27 Jakub Jelinek <jakub@redhat.com>
* malloc/arena.c (ptmalloc_init): Don't call next_env_entry if
_environ is NULL.
--- libc/malloc/arena.c.jj 2002-12-12 01:38:54.000000000 +0100
+++ libc/malloc/arena.c 2002-12-27 02:19:17.000000000 +0100
@@ -436,49 +436,50 @@ ptmalloc_init __MALLOC_P((void))
#ifdef _LIBC
secure = __libc_enable_secure;
s = NULL;
- {
- char **runp = _environ;
- char *envline;
-
- while (__builtin_expect ((envline = next_env_entry (&runp)) != NULL,
- 0))
- {
- size_t len = strcspn (envline, "=");
-
- if (envline[len] != '=')
- /* This is a "MALLOC_" variable at the end of the string
- without a '=' character. Ignore it since otherwise we
- will access invalid memory below. */
- continue;
-
- switch (len)
- {
- case 6:
- if (memcmp (envline, "CHECK_", 6) == 0)
- s = &envline[7];
- break;
- case 8:
- if (! secure && memcmp (envline, "TOP_PAD_", 8) == 0)
- mALLOPt(M_TOP_PAD, atoi(&envline[9]));
- break;
- case 9:
- if (! secure && memcmp (envline, "MMAP_MAX_", 9) == 0)
- mALLOPt(M_MMAP_MAX, atoi(&envline[10]));
- break;
- case 15:
- if (! secure)
- {
- if (memcmp (envline, "TRIM_THRESHOLD_", 15) == 0)
- mALLOPt(M_TRIM_THRESHOLD, atoi(&envline[16]));
- else if (memcmp (envline, "MMAP_THRESHOLD_", 15) == 0)
- mALLOPt(M_MMAP_THRESHOLD, atoi(&envline[16]));
- }
- break;
- default:
- break;
- }
- }
- }
+ if (__builtin_expect (_environ != NULL, 1))
+ {
+ char **runp = _environ;
+ char *envline;
+
+ while (__builtin_expect ((envline = next_env_entry (&runp)) != NULL,
+ 0))
+ {
+ size_t len = strcspn (envline, "=");
+
+ if (envline[len] != '=')
+ /* This is a "MALLOC_" variable at the end of the string
+ without a '=' character. Ignore it since otherwise we
+ will access invalid memory below. */
+ continue;
+
+ switch (len)
+ {
+ case 6:
+ if (memcmp (envline, "CHECK_", 6) == 0)
+ s = &envline[7];
+ break;
+ case 8:
+ if (! secure && memcmp (envline, "TOP_PAD_", 8) == 0)
+ mALLOPt(M_TOP_PAD, atoi(&envline[9]));
+ break;
+ case 9:
+ if (! secure && memcmp (envline, "MMAP_MAX_", 9) == 0)
+ mALLOPt(M_MMAP_MAX, atoi(&envline[10]));
+ break;
+ case 15:
+ if (! secure)
+ {
+ if (memcmp (envline, "TRIM_THRESHOLD_", 15) == 0)
+ mALLOPt(M_TRIM_THRESHOLD, atoi(&envline[16]));
+ else if (memcmp (envline, "MMAP_THRESHOLD_", 15) == 0)
+ mALLOPt(M_MMAP_THRESHOLD, atoi(&envline[16]));
+ }
+ break;
+ default:
+ break;
+ }
+ }
+ }
#else
if (! secure)
{
Jakub
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [PATCH] Fix malloc after clearenv
2002-12-26 16:09 [PATCH] Fix malloc after clearenv Jakub Jelinek
@ 2002-12-26 16:36 ` Roland McGrath
0 siblings, 0 replies; 2+ messages in thread
From: Roland McGrath @ 2002-12-26 16:36 UTC (permalink / raw)
To: Jakub Jelinek; +Cc: Ulrich Drepper, Glibc hackers
> 2002-12-27 Jakub Jelinek <jakub@redhat.com>
>
> * malloc/arena.c (ptmalloc_init): Don't call next_env_entry if
> _environ is NULL.
I put the patch in.
Thanks,
Roland
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2002-12-27 0:36 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2002-12-26 16:09 [PATCH] Fix malloc after clearenv Jakub Jelinek
2002-12-26 16:36 ` Roland McGrath
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).