| commit | 12978acb3066db738c8c15121e81adbb63739876 | [log] [tgz] |
|---|---|---|
| author | Szabolcs Nagy <nsz@port70.net> | Thu Nov 26 19:59:46 2015 +0100 |
| committer | Rich Felker <dalias@aerifal.cx> | Sat Nov 28 13:34:17 2015 -0500 |
| tree | ad1b75f4b307190f31416438b8c6de8494c8f62e | |
| parent | 8eead3ef18ea71a64ef3cbff8c09bac3b82f1242 [diff] |
ldso: fix the dtv update logic in __tls_get_new if two or more threads accessed tls in a dso that was loaded after the threads were created, then __tls_get_new could do out-of-bound memory access (leading to segfault). accidentally byte count was used instead of element count when the new dtv pointer was computed. (dso->new_dtv is (void**).) it is rare that the same dso provides dtv for several threads, the crash was not observed in practice, but possible to trigger.