[PATCH] Properly initialize dynamically created '_atexit' structures

[Corinna Vinschen]

On Aug 16 17:53, Meador Inge wrote:
> Hi All,
> 
> This patch fixes an issue that occurs when greater than _ATEXIT_SIZE
> exit procedures of type '__et_cxa' are registered, small reentrant
> structure support is enabled, and dynamic allocation of atexit entries
> is enabled.  This bug is fairly easy to run into if you have a C++
> program with lots of objects that have static storage duration.  The
> control flow where the problem is encountered in '__register_exitproc'
> goes like:
> 
>    1. 'p->_ind >= _ATEXIT_SIZE' is true and a new '_atexit' structure
>       is dynamically allocated and stored in 'p'.
> 
>    2. 'p->_on_exit_args_ptr' is *not* set to NULL.
> 
>    3. 'type != __et_atexit' is true.
> 
>    4. At this point a new '_on_exit_args' structure should be created
>       as well, but if 'p->_on_exit_args_ptr' happens to be non-NULL,
>       then it isn't and bad things happen later when 'p->_on_exit_args_ptr'
>       is used.
> 
> The problem is fixed by properly initializing '_on_exit_args_ptr' to
> NULL.
> 
> OK?
> 
> 2013-08-16  Meador Inge  <...>
> 
> 	* libc/stdlib/__atexit.c (__register_exitproc): NULL-ify
> 	'_on_exit_args_ptr' when creating a new '_atexit' structure
> 	while '_REENT_SMALL' is defined.

Patch applied.


Thanks,
Corinna

-- 
Corinna Vinschen
Cygwin Maintainer
Red Hat
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 836 bytes
Desc: not available
URL: <http://sourceware.org/pipermail/newlib/attachments/20130819/c25e52a2/attachment.sig>