about summary refs log tree commit diff
path: root/wcsmbs
diff options
context:
space:
mode:
authorFlorian Weimer <fweimer@redhat.com>2019-05-21 10:19:46 +0200
committerFlorian Weimer <fweimer@redhat.com>2019-05-21 12:04:55 +0200
commitc9c15ac3162d10a999bf71418fd710bf5676175e (patch)
tree2264f9e56c7bad8288111a10ac2ff1aad8a317b3 /wcsmbs
parent7e740ab2e7be7d83b75513aa406e0b10875f7f9c (diff)
downloadglibc-c9c15ac3162d10a999bf71418fd710bf5676175e.tar.gz
glibc-c9c15ac3162d10a999bf71418fd710bf5676175e.tar.xz
glibc-c9c15ac3162d10a999bf71418fd710bf5676175e.zip
wcsmbs: Fix data race in __wcsmbs_clone_conv [BZ #24584]
This also adds an overflow check and documents the synchronization
requirement in <gconv.h>.
Diffstat (limited to 'wcsmbs')
-rw-r--r--wcsmbs/wcsmbsload.c22
1 files changed, 18 insertions, 4 deletions
diff --git a/wcsmbs/wcsmbsload.c b/wcsmbs/wcsmbsload.c
index 10e1a4f4f5..840d4abc44 100644
--- a/wcsmbs/wcsmbsload.c
+++ b/wcsmbs/wcsmbsload.c
@@ -20,6 +20,7 @@
 #include <langinfo.h>
 #include <limits.h>
 #include <stdlib.h>
+#include <stdio.h>
 #include <string.h>
 
 #include <locale/localeinfo.h>
@@ -223,12 +224,25 @@ __wcsmbs_clone_conv (struct gconv_fcts *copy)
   /* Copy the data.  */
   *copy = *orig;
 
-  /* Now increment the usage counters.
-     Note: This assumes copy->*_nsteps == 1.  */
+  /* Now increment the usage counters.  Note: This assumes
+     copy->*_nsteps == 1.  The current locale holds a reference, so it
+     is still there after acquiring the lock.  */
+
+  __libc_lock_lock (__gconv_lock);
+
+  bool overflow = false;
   if (copy->towc->__shlib_handle != NULL)
-    ++copy->towc->__counter;
+    overflow |= __builtin_add_overflow (copy->towc->__counter, 1,
+					&copy->towc->__counter);
   if (copy->tomb->__shlib_handle != NULL)
-    ++copy->tomb->__counter;
+    overflow |= __builtin_add_overflow (copy->tomb->__counter, 1,
+					&copy->tomb->__counter);
+
+  __libc_lock_unlock (__gconv_lock);
+
+  if (overflow)
+    __libc_fatal ("\
+Fatal glibc error: gconv module reference counter overflow\n");
 }