JehanneOS/newlib
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Cygwin: posix timers: allocate timer_tracker on system heap.

Browse Source 
Allocating on the cygheap would copy information of the tracker into
the child process.  A forked child knows the timer id and could simply
still access the (free'd but still valid) timer_tracker on the heap,
which is dangerous and very certainly doesn't reflect POSIX semantics.

Signed-off-by: Corinna Vinschen <corinna@vinschen.de>
This commit is contained in:
Corinna Vinschen 2019-01-22 16:22:45 +01:00
parent 6c44af8179
commit 83c51fffe6
3 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
winsup/cygwin/cygheap_malloc.h
View File

@ -34,8 +34,7 @@ enum cygheap_types
HEAP_2_DLL, HEAP_2_DLL,
HEAP_MMAP, HEAP_MMAP,
HEAP_2_MAX = 200, HEAP_2_MAX = 200,
HEAP_3_FHANDLER, HEAP_3_FHANDLER
HEAP_3_TIMER
}; };
extern "C" { extern "C" {

5
winsup/cygwin/posix_timer.cc
View File

@ -414,10 +414,11 @@ timer_tracker::settime (int flags, const itimerspec *new_value,
return ret; return ret;
} }
/* The timers are stored on the cygheap. */ /* The timers are stored on the system heap in order to avoid accidental
leaking of timer ids into the child process. */
#define cnew(name, ...) \ #define cnew(name, ...) \
({ \ ({ \
void* ptr = (void*) ccalloc (HEAP_3_TIMER, 1, sizeof (name)); \ void* ptr = (void*) HeapAlloc (GetProcessHeap (), 0, sizeof (name)); \
ptr ? new (ptr) name (__VA_ARGS__) : NULL; \ ptr ? new (ptr) name (__VA_ARGS__) : NULL; \
}) })

2
winsup/cygwin/posix_timer.h
View File

@ -30,7 +30,7 @@ class timer_tracker
public: public:
void *operator new (size_t, void *p) __attribute__ ((nothrow)) {return p;} void *operator new (size_t, void *p) __attribute__ ((nothrow)) {return p;}
void operator delete (void *p) { cfree (p); } void operator delete (void *p) { HeapFree (GetProcessHeap (), 0, p); }
timer_tracker (clockid_t, const sigevent *); timer_tracker (clockid_t, const sigevent *);
~timer_tracker (); ~timer_tracker ();
inline bool is_timer_tracker () const { return magic == TT_MAGIC; } inline bool is_timer_tracker () const { return magic == TT_MAGIC; }