[PATCH] iconv_open: Fix heap corruption on gconv_init failure [BZ #22026]

[Florian Weimer]

On 08/29/2017 05:06 PM, Andreas Schwab wrote:
> On Aug 29 2017, fweimer@redhat.com (Florian Weimer) wrote:
> 
>> diff --git a/iconv/gconv_db.c b/iconv/gconv_db.c
>> index b748467de5..de3e5d92fe 100644
>> --- a/iconv/gconv_db.c
>> +++ b/iconv/gconv_db.c
>> @@ -318,9 +318,12 @@ gen_steps (struct derivation_step *best, const char *toset,
>>  		  if (__builtin_expect (status, __GCONV_OK) != __GCONV_OK)
>>  		    {
>>  		      failed = 1;
>> -		      /* Make sure we unload this modules.  */
>> -		      --step_cnt;
>> +		      /* Do not call the end function because the init
>> +			 function has failed.  */
>>  		      result[step_cnt].__end_fct = NULL;
>> +# ifdef PTR_MANGLE
>> +		      PTR_MANGLE (result[step_cnt].__end_fct);
>> +# endif
> 
> You still need to decrement step_cnt, otherwise you have a resource
> leak.

Like this?

Thanks,
Florian
-------------- next part --------------
A non-text attachment was scrubbed...
Name: gconv-gen_steps-2.patch
Type: text/x-patch
Size: 7278 bytes
Desc: not available
URL: <http://sourceware.org/pipermail/libc-alpha/attachments/20170829/5232165e/attachment.bin>