[Bug libc/18292] Invalid pointer dereference in nsswitch.c:nss_new_service()

["fweimer at redhat dot com" <sourceware-bugzilla at sourceware dot org>]

https://sourceware.org/bugzilla/show_bug.cgi?id=18292

--- Comment #13 from Florian Weimer <fweimer at redhat dot com> ---
(In reply to Justin N. Ferguson from comment #12)
> I haven't tried this out or worked it all the way through in my head, so
> YMMV, it just occurred to me last night, but what if a block is in the
> process of being written to in one thread, and in another the following
> block is being consolidated or similar? There's a race; the returned
> allocations really shouldn't be overlapping like this. 

Consolidation only happens between chunks which are unused.  The arena lock
prevents a chunks from switching from unused to used during this processing. 
At least this is my understanding.

> Consider the code path in __libc_realloc() where _int_realloc() fails, but
> the subsequent call to __libc_malloc() succeeds, and during the memcpy() the
> block following the returned one is free'd? 

That's a race in the calling application, I think.

-- 
You are receiving this mail because:
You are on the CC list for the bug.