diff options
| -rw-r--r-- | ChangeLog | 5 | ||||
| -rw-r--r-- | nscd/connections.c | 10 | ||||
| -rw-r--r-- | nscd/nscd_helper.c | 21 | ||||
| -rw-r--r-- | sysdeps/i386/dl-trampoline.S | 5 |
4 files changed, 33 insertions, 8 deletions
@@ -1,5 +1,10 @@ 2007-10-06 Ulrich Drepper <drepper@redhat.com> + [BZ #3924] + * sysdeps/i386/dl-trampoline.S (_dl_runtime_profile): Fix a few + more little bugs in creating the stack frame when pltexit has to + be called. + * nscd/nscd_helper.c (__nscd_cache_search): Prevent endless loops. * nscd/connections.c (verify_persistent_db): Recognize circular lists. diff --git a/nscd/connections.c b/nscd/connections.c index 2572a42ee7..26d75d2978 100644 --- a/nscd/connections.c +++ b/nscd/connections.c @@ -378,8 +378,9 @@ verify_persistent_db (void *mem, struct database_pers_head *readhead, int dbnr) nscd_ssize_t he_cnt = 0; for (nscd_ssize_t cnt = 0; cnt < head->module; ++cnt) { - ref_t first = head->array[cnt]; - ref_t work = first; + ref_t trail = head->array[cnt]; + ref_t work = trail; + int tick = 0; while (work != ENDREF) { @@ -439,9 +440,12 @@ verify_persistent_db (void *mem, struct database_pers_head *readhead, int dbnr) work = here->next; - if (work == first) + if (work == trail) /* A circular list, this must not happen. */ goto fail; + if (tick) + trail = ((struct hashentry *) (data + trail))->next; + tick = 1 - tick; } } diff --git a/nscd/nscd_helper.c b/nscd/nscd_helper.c index 2e6d5f76b8..6718d922f3 100644 --- a/nscd/nscd_helper.c +++ b/nscd/nscd_helper.c @@ -416,8 +416,10 @@ __nscd_cache_search (request_type type, const char *key, size_t keylen, unsigned long int hash = __nis_hash (key, keylen) % mapped->head->module; size_t datasize = mapped->datasize; - ref_t first = mapped->head->array[hash]; - ref_t work = first; + ref_t trail = mapped->head->array[hash]; + ref_t work = trail; + int tick = 0; + while (work != ENDREF && work + sizeof (struct hashentry) <= datasize) { struct hashentry *here = (struct hashentry *) (mapped->data + work); @@ -457,8 +459,21 @@ __nscd_cache_search (request_type type, const char *key, size_t keylen, work = here->next; /* Prevent endless loops. This should never happen but perhaps the database got corrupted, accidentally or deliberately. */ - if (work == first) + if (work == trail) break; + if (tick) + { + struct hashentry *trailelem; + trailelem = (struct hashentry *) (mapped->data + trail); + +#ifndef _STRING_ARCH_unaligned + /* We have to redo the checks. Maybe the data changed. */ + if ((uintptr_t) trailelem & (__alignof__ (*trailelem) - 1)) + return NULL; +#endif + trail = trailelem->next; + } + tick = 1 - tick; } return NULL; diff --git a/sysdeps/i386/dl-trampoline.S b/sysdeps/i386/dl-trampoline.S index af9eaf6d56..73b08ba67e 100644 --- a/sysdeps/i386/dl-trampoline.S +++ b/sysdeps/i386/dl-trampoline.S @@ -113,6 +113,7 @@ _dl_runtime_profile: movl %ebx, %ecx orl $4, %ebx # Increase frame size if necessary to align # stack for the function call + andl $~3, %ebx movl %esp, %edi subl %ebx, %edi movl %esp, %ebx @@ -121,9 +122,9 @@ _dl_runtime_profile: shrl $2, %ecx rep movsl - movl (%edi), %esi + movl (%ebx), %esi cfi_restore (esi) - movl 4(%edi), %edi + movl 4(%ebx), %edi cfi_restore (edi) /* %ebx+40 return address |