diff options
Diffstat (limited to 'meta/recipes-core/glibc/glibc/CVE-2021-33574.patch')
| -rw-r--r-- | meta/recipes-core/glibc/glibc/CVE-2021-33574.patch | 61 |
1 files changed, 0 insertions, 61 deletions
diff --git a/meta/recipes-core/glibc/glibc/CVE-2021-33574.patch b/meta/recipes-core/glibc/glibc/CVE-2021-33574.patch deleted file mode 100644 index fd73b23c88..0000000000 --- a/meta/recipes-core/glibc/glibc/CVE-2021-33574.patch +++ /dev/null @@ -1,61 +0,0 @@ -From 42d359350510506b87101cf77202fefcbfc790cb Mon Sep 17 00:00:00 2001 -From: Andreas Schwab <schwab@linux-m68k.org> -Date: Thu, 27 May 2021 12:49:47 +0200 -Subject: [PATCH] Use __pthread_attr_copy in mq_notify (bug 27896) - -Make a deep copy of the pthread attribute object to remove a potential -use-after-free issue. - -Upstream-Status: Backport [https://sourceware.org/git/?p=glibc.git;a=commit;h=42d359350510506b87101cf77202fefcbfc790cb] -CVE: CVE-2021-33574 -Signed-off-by: Vinay Kumar <vinay.m.engg@gmail.com> ---- -diff --git a/sysdeps/unix/sysv/linux/mq_notify.c b/sysdeps/unix/sysv/linux/mq_notify.c -index cc575a0cdd8..6f46d29d1dc 100644 ---- a/sysdeps/unix/sysv/linux/mq_notify.c -+++ b/sysdeps/unix/sysv/linux/mq_notify.c -@@ -133,8 +133,11 @@ helper_thread (void *arg) - (void) __pthread_barrier_wait (¬ify_barrier); - } - else if (data.raw[NOTIFY_COOKIE_LEN - 1] == NOTIFY_REMOVED) -- /* The only state we keep is the copy of the thread attributes. */ -- free (data.attr); -+ { -+ /* The only state we keep is the copy of the thread attributes. */ -+ pthread_attr_destroy (data.attr); -+ free (data.attr); -+ } - } - return NULL; - } -@@ -255,8 +258,14 @@ mq_notify (mqd_t mqdes, const struct sigevent *notification) - if (data.attr == NULL) - return -1; - -- memcpy (data.attr, notification->sigev_notify_attributes, -- sizeof (pthread_attr_t)); -+ int ret = __pthread_attr_copy (data.attr, -+ notification->sigev_notify_attributes); -+ if (ret != 0) -+ { -+ free (data.attr); -+ __set_errno (ret); -+ return -1; -+ } - } - - /* Construct the new request. */ -@@ -269,8 +278,11 @@ mq_notify (mqd_t mqdes, const struct sigevent *notification) - int retval = INLINE_SYSCALL (mq_notify, 2, mqdes, &se); - - /* If it failed, free the allocated memory. */ -- if (__glibc_unlikely (retval != 0)) -- free (data.attr); -+ if (retval != 0 && data.attr != NULL) -+ { -+ pthread_attr_destroy (data.attr); -+ free (data.attr); -+ } - - return retval; - } |