about summary refs log tree commit diff
path: root/elf/dl-close.c
diff options
context:
space:
mode:
authorAndreas Schwab <schwab@redhat.com>2012-06-22 11:10:31 -0700
committerCarlos O'Donell <carlos_odonell@mentor.com>2012-06-22 11:10:31 -0700
commit0479b305c5b7c8e3fa8e3002982cf8cac02b842e (patch)
treef72a6cb6c122c086d6e7b5989e9d746c0c3431a1 /elf/dl-close.c
parent0e3933b96344ab9c0ac633c19f4ebfdede5375d4 (diff)
downloadglibc-0479b305c5b7c8e3fa8e3002982cf8cac02b842e.tar.gz
glibc-0479b305c5b7c8e3fa8e3002982cf8cac02b842e.tar.xz
glibc-0479b305c5b7c8e3fa8e3002982cf8cac02b842e.zip
Fix invalid memory access in do_lookup_x.
[BZ #13579] Do not free l_initfini and allow it to be reused
on subsequent dl_open calls for the same library. This fixes
the invalid memory access in do_lookup_x when the previously
free'd l_initfini was accessed through l_searchlist when a
library had been opened for the second time.
Diffstat (limited to 'elf/dl-close.c')
-rw-r--r--elf/dl-close.c15
1 files changed, 3 insertions, 12 deletions
diff --git a/elf/dl-close.c b/elf/dl-close.c
index d232294665..a250ea5e3e 100644
--- a/elf/dl-close.c
+++ b/elf/dl-close.c
@@ -1,5 +1,5 @@
 /* Close a shared object opened by `_dl_open'.
-   Copyright (C) 1996-2007, 2009, 2010, 2011 Free Software Foundation, Inc.
+   Copyright (C) 1996-2012 Free Software Foundation, Inc.
    This file is part of the GNU C Library.
 
    The GNU C Library is free software; you can redistribute it and/or
@@ -118,17 +118,8 @@ _dl_close_worker (struct link_map *map)
   if (map->l_direct_opencount > 0 || map->l_type != lt_loaded
       || dl_close_state != not_pending)
     {
-      if (map->l_direct_opencount == 0)
-	{
-	  if (map->l_type == lt_loaded)
-	    dl_close_state = rerun;
-	  else if (map->l_type == lt_library)
-	    {
-	      struct link_map **oldp = map->l_initfini;
-	      map->l_initfini = map->l_orig_initfini;
-	      _dl_scope_free (oldp);
-	    }
-	}
+      if (map->l_direct_opencount == 0 && map->l_type == lt_loaded)
+	dl_close_state = rerun;
 
       /* There are still references to this object.  Do nothing more.  */
       if (__builtin_expect (GLRO(dl_debug_mask) & DL_DEBUG_FILES, 0))