diff options
| author | Christophe Lyon <christophe.lyon@st.com> | 2018-07-04 17:55:41 +0200 |
|---|---|---|
| committer | Waldemar Brodkorb <wbrodkorb@conet.de> | 2018-08-10 16:02:45 +0200 |
| commit | b5ec02b92c19dd3ab63aa7017682f60dec8f3ccc (patch) | |
| tree | 37f5985cd504d14cfb623c4712e7d5d636d7f21e | |
| parent | a7d538fddb21427681704e027e2fdea2bed686c7 (diff) | |
Fix htab_delete loop counter
dlclose can crash or stuck the system:
When calling dlclose() then system can crash or freeze, because
htab_delete() in ldso/ldso/fdpic/dl-inlines.h uses size_t for i which
is a typedef to unsigned int. We exit the loop on negative value of i
which can never occur since i is an unsigned int. This leads to random
free of various pointers that kill the system.
* ldso/include/inline-hashtab.h (htab_delete): Change type of 'i' to int.
Signed-off-by: Mickaël Guêné <mickael.guene@st.com>
Signed-off-by: Christophe Lyon <christophe.lyon@st.com>
| -rw-r--r-- | ldso/include/inline-hashtab.h | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/ldso/include/inline-hashtab.h b/ldso/include/inline-hashtab.h index 4a4812027..c6c584b08 100644 --- a/ldso/include/inline-hashtab.h +++ b/ldso/include/inline-hashtab.h @@ -107,7 +107,7 @@ htab_create(void) static __always_inline void htab_delete(struct funcdesc_ht *htab) { - size_t i; + int i; for (i = htab->size - 1; i >= 0; i--) if (htab->entries[i]) |