From c9c15ac3162d10a999bf71418fd710bf5676175e Mon Sep 17 00:00:00 2001 From: Florian Weimer Date: Tue, 21 May 2019 10:19:46 +0200 Subject: wcsmbs: Fix data race in __wcsmbs_clone_conv [BZ #24584] This also adds an overflow check and documents the synchronization requirement in . --- wcsmbs/wcsmbsload.c | 22 ++++++++++++++++++---- 1 file changed, 18 insertions(+), 4 deletions(-) (limited to 'wcsmbs') diff --git a/wcsmbs/wcsmbsload.c b/wcsmbs/wcsmbsload.c index 10e1a4f4f5..840d4abc44 100644 --- a/wcsmbs/wcsmbsload.c +++ b/wcsmbs/wcsmbsload.c @@ -20,6 +20,7 @@ #include #include #include +#include #include #include @@ -223,12 +224,25 @@ __wcsmbs_clone_conv (struct gconv_fcts *copy) /* Copy the data. */ *copy = *orig; - /* Now increment the usage counters. - Note: This assumes copy->*_nsteps == 1. */ + /* Now increment the usage counters. Note: This assumes + copy->*_nsteps == 1. The current locale holds a reference, so it + is still there after acquiring the lock. */ + + __libc_lock_lock (__gconv_lock); + + bool overflow = false; if (copy->towc->__shlib_handle != NULL) - ++copy->towc->__counter; + overflow |= __builtin_add_overflow (copy->towc->__counter, 1, + ©->towc->__counter); if (copy->tomb->__shlib_handle != NULL) - ++copy->tomb->__counter; + overflow |= __builtin_add_overflow (copy->tomb->__counter, 1, + ©->tomb->__counter); + + __libc_lock_unlock (__gconv_lock); + + if (overflow) + __libc_fatal ("\ +Fatal glibc error: gconv module reference counter overflow\n"); } -- cgit 1.4.1