mirror of
https://sourceware.org/git/glibc.git
synced 2024-12-13 06:40:09 +00:00
7947430322
Helper thread frees copied attribute on NOTIFY_REMOVED message
received from the OS kernel. Unfortunately, it fails to check whether
copied attribute actually exists (data.attr != NULL). This worked
earlier because free() checks passed pointer before actually
attempting to release corresponding memory. But
__pthread_attr_destroy assumes pointer is not NULL.
So passing NULL pointer to __pthread_attr_destroy will result in
segmentation fault. This scenario is possible if
notification->sigev_notify_attributes == NULL (which means default
thread attributes should be used).
Signed-off-by: Nikita Popov <npv1310@gmail.com>
Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
(cherry picked from commit
|
||
|---|---|---|
| .. | ||
| alpha | ||
| arm | ||
| bsd | ||
| i386 | ||
| inet | ||
| mips | ||
| powerpc | ||
| sh | ||
| sysv/linux | ||
| x86_64 | ||
| confstr.h | ||
| get_child_max.c | ||
| getlogin_r.c | ||
| getlogin.c | ||
| getpagesize.c | ||
| grantpt.c | ||
| ifreq.c | ||
| Implies | ||
| make-syscalls.sh | ||
| Makefile | ||
| s-proto-cancel.S | ||
| s-proto.S | ||
| setxid.h | ||
| sockatmark.c | ||
| syscall-template.S | ||
| syscall.S | ||
| syscalls.list | ||
| sysdep.h | ||