[Bug nptl/3317] New: Overriding free which clobbers data and calls pthread_getspecific can get bad value

["ian at airs dot com" <sourceware-bugzilla at sourceware dot org>]

If I override the libc free() function, and change that function to clobber some
bytes of the data, and then call pthread_getspecific from that function,
pthread_getspecific can return bad data.  This is because __nptl_deallocate_tsd
frees data before clearing the pointer to that data.  This happens around line 185:

	      /* The first block is allocated as part of the thread
		 descriptor.  */
	      free (level2);
	      THREAD_SETMEM_NC (self, specific, cnt, NULL);

The order of those lines should be reversed.

I first noticed this bug in linuxthreads, and then discovered that NPTL had the
same bug.  I will file a separate bug against linuxthreads.

I will attach a test case which shows the problem on i686-pc-linux-gnu using
Fedora Core 4 with glibc-2.3.6-3.

-- 
           Summary: Overriding free which clobbers data and calls
                    pthread_getspecific can get bad value
           Product: glibc
           Version: 2.3.6
            Status: NEW
          Severity: normal
          Priority: P2
         Component: nptl
        AssignedTo: drepper at redhat dot com
        ReportedBy: ian at airs dot com
                CC: glibc-bugs at sources dot redhat dot com


http://sourceware.org/bugzilla/show_bug.cgi?id=3317

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.