This is the mail archive of the
glibc-cvs@sourceware.org
mailing list for the glibc project.
GNU C Library master sources branch release/2.25/master updated. glibc-2.25-129-g7118ba3
- From: stli at sourceware dot org
- To: glibc-cvs at sourceware dot org
- Date: 10 Sep 2018 12:29:53 -0000
- Subject: GNU C Library master sources branch release/2.25/master updated. glibc-2.25-129-g7118ba3
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GNU C Library master sources".
The branch, release/2.25/master has been updated
via 7118ba34931d27f538c71c1cd355866f8db83f4e (commit)
from 1324858a3fd3d0291f9dec45f771881ba7209150 (commit)
Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.
- Log -----------------------------------------------------------------
http://sourceware.org/git/gitweb.cgi?p=glibc.git;a=commitdiff;h=7118ba34931d27f538c71c1cd355866f8db83f4e
commit 7118ba34931d27f538c71c1cd355866f8db83f4e
Author: Stefan Liebler <stli@linux.ibm.com>
Date: Thu Sep 6 14:27:03 2018 +0200
Fix segfault in maybe_script_execute.
If glibc is built with gcc 8 and -march=z900,
the testcase posix/tst-spawn4-compat crashes with a segfault.
In function maybe_script_execute, the new_argv array is dynamically
initialized on stack with (argc + 1) elements.
The function wants to add _PATH_BSHELL as the first argument
and writes out of bounds of new_argv.
There is an off-by-one because maybe_script_execute fails to count
the terminating NULL when sizing new_argv.
ChangeLog:
* sysdeps/unix/sysv/linux/spawni.c (maybe_script_execute):
Increment size of new_argv by one.
(cherry picked from commit 28669f86f6780a18daca264f32d66b1428c9c6f1)
diff --git a/ChangeLog b/ChangeLog
index 7349a33..043e589 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+2018-09-06 Stefan Liebler <stli@linux.ibm.com>
+
+ * sysdeps/unix/sysv/linux/spawni.c (maybe_script_execute):
+ Increment size of new_argv by one.
+
2018-08-27 Martin Kuchta <martin.kuchta@netapp.com>
Torvald Riegel <triegel@redhat.com>
diff --git a/sysdeps/unix/sysv/linux/spawni.c b/sysdeps/unix/sysv/linux/spawni.c
index ee09fb7..f3ef6e6 100644
--- a/sysdeps/unix/sysv/linux/spawni.c
+++ b/sysdeps/unix/sysv/linux/spawni.c
@@ -101,7 +101,7 @@ maybe_script_execute (struct posix_spawn_args *args)
ptrdiff_t argc = args->argc;
/* Construct an argument list for the shell. */
- char *new_argv[argc + 1];
+ char *new_argv[argc + 2];
new_argv[0] = (char *) _PATH_BSHELL;
new_argv[1] = (char *) args->file;
if (argc > 1)
-----------------------------------------------------------------------
Summary of changes:
ChangeLog | 5 +++++
sysdeps/unix/sysv/linux/spawni.c | 2 +-
2 files changed, 6 insertions(+), 1 deletions(-)
hooks/post-receive
--
GNU C Library master sources