elf: Fix memory leak in _dl_find_object_update (bug 29062)

Message ID 87h76x3zni.fsf@oldenburg.str.redhat.com
State Committed
Headers
Series elf: Fix memory leak in _dl_find_object_update (bug 29062) |

Checks

Context Check Description
dj/TryBot-apply_patch success Patch applied to master at the time it was sent
dj/TryBot-32bit success Build for i686

Commit Message

Florian Weimer April 13, 2022, 1:01 p.m. UTC
  The count can be zero if an object has already been loaded as
an indirect dependency (so that l_searchlist.r_list in its link
map is still NULL) is promoted to global scope via RTLD_GLOBAL.

Fixes commit 5d28a8962dc ("elf: Add _dl_find_object function").

---
 elf/dl-find_object.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)
  

Comments

Andreas Schwab April 13, 2022, 1:11 p.m. UTC | #1
On Apr 13 2022, Florian Weimer via Libc-alpha wrote:

> The count can be zero if an object has already been loaded as
> an indirect dependency (so that l_searchlist.r_list in its link
> map is still NULL) is promoted to global scope via RTLD_GLOBAL.
>
> Fixes commit 5d28a8962dc ("elf: Add _dl_find_object function").

Ok.
  

Patch

diff --git a/elf/dl-find_object.c b/elf/dl-find_object.c
index 2b8df2fd67..4d5831b6f4 100644
--- a/elf/dl-find_object.c
+++ b/elf/dl-find_object.c
@@ -788,6 +788,9 @@  _dl_find_object_update (struct link_map *new_map)
   for (struct link_map *l = new_map; l != NULL; l = l->l_next)
     /* Skip proxy maps and already-processed maps.  */
     count += l == l->l_real && !l->l_find_object_processed;
+  if (count == 0)
+    return true;
+
   struct link_map **map_array = malloc (count * sizeof (*map_array));
   if (map_array == NULL)
     return false;
@@ -797,8 +800,6 @@  _dl_find_object_update (struct link_map *new_map)
       if (l == l->l_real && !l->l_find_object_processed)
         map_array[i++] = l;
   }
-  if (count == 0)
-    return true;
 
   _dl_find_object_link_map_sort (map_array, count);
   bool ok = _dl_find_object_update_1 (map_array, count);