[PATCH 15/20] Fix off-by-one OOB read in elf/tst-tls20

Szabolcs Nagy szabolcs.nagy@arm.com
Thu Oct 27 15:33:30 GMT 2022


The int mods[nmods] array on the stack was overread by one.
---
 elf/tst-tls20.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/elf/tst-tls20.c b/elf/tst-tls20.c
index ce4635eeb1..9cebe22a40 100644
--- a/elf/tst-tls20.c
+++ b/elf/tst-tls20.c
@@ -264,7 +264,7 @@ do_test_dependency (void)
 	  xdlclose (moddep);
 	}
 
-      for (int n = 1; n <= nmods; n++)
+      for (int n = 1; n < nmods; n++)
 	if (mods[n] != 0)
 	  unload_mod (n);
     }
@@ -342,7 +342,7 @@ do_test_invalid_dependency (bool bind_now)
 	    xdlclose (moddep);
 	}
 
-      for (int n = 1; n <= nmods; n++)
+      for (int n = 1; n < nmods; n++)
 	if (mods[n] != 0)
 	  unload_mod (n);
     }
-- 
2.25.1



More information about the Libc-alpha mailing list