Bug 12469 - Race condition in configure.in check for necessary ranlib
Summary: Race condition in configure.in check for necessary ranlib
Status: RESOLVED FIXED
Alias: None
Product: glibc
Classification: Unclassified
Component: libc (show other bugs)
Version: 2.13
: P2 minor
Target Milestone: ---
Assignee: Ulrich Drepper
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2011-02-06 21:22 UTC by Bruce Dubbs
Modified: 2014-06-27 13:52 UTC (History)
1 user (show)

See Also:
Host:
Target:
Build:
Last reconfirmed:
fweimer: security-


Attachments
Wait the beginning of a second to create archive (603 bytes, patch)
2011-02-15 06:59 UTC, Gilles Espinasse
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Bruce Dubbs 2011-02-06 21:22:47 UTC
In configure.in, starting at line 1098, the code to check if ranlib is necessary is:

# check if ranlib is necessary
AC_CACHE_CHECK(whether ranlib is necessary, libc_cv_ranlib_necessary, [dnl
cat > conftest.c <<EOF
int a;
char b;
void c(void) {}
EOF
$CC $CFLAGS $CPPFLAGS -c conftest.c
$AR cr conftest.a conftest.o
cp conftest.a conftest2.a
$RANLIB conftest.a
if cmp -s conftest.a conftest2.a; then
  libc_cv_ranlib_necessary=no
else
  libc_cv_ranlib_necessary=yes
fi

Under some infrequent timing conditions, the test can sometimes return yes when it shouldn't.  This is because ranlib adds a timestamp from byte position 24 to 33 that can differ between the creation of conftest.a and it's modification two lines later.

I suggest changing the comparison test to:

  if cmp -s -i34 conftest.a conftest2.a; then
Comment 1 Gilles Espinasse 2011-02-15 06:59:26 UTC
Created attachment 5240 [details]
Wait the beginning of a second to create archive

Another option to cmp -i is to wait the beginning of a second to create the archive. This should give enought time at ranlib to run on that same second.
Comment 2 Gilles Espinasse 2011-02-15 07:24:13 UTC
Could use date '+%S' instead of '+%s', much clearer with a smaller number
Comment 3 Ulrich Drepper 2011-02-15 19:53:43 UTC
ranlib is unnecessary these days since we require late binutils anyway.  The support just wasn't removed because it didn't cause problems.  If it does cause problems it should just be removed.