diff options
author | Jilles Tjoelker <jilles@FreeBSD.org> | 2016-01-22 14:52:31 +0000 |
---|---|---|
committer | Jilles Tjoelker <jilles@FreeBSD.org> | 2016-01-22 14:52:31 +0000 |
commit | afa04e4170378d8130154c606c0199a8de705a54 (patch) | |
tree | d88421ab67feaf6d316ac1cf7b5df3c38584a56a /tools/regression | |
parent | 636208024586d0fb3053105b200f5b2c41796d21 (diff) | |
download | src-afa04e4170378d8130154c606c0199a8de705a54.tar.gz src-afa04e4170378d8130154c606c0199a8de705a54.zip |
sem: Don't free nameinfo that is still in list when open() fails.
This bug could be reproduced easily by calling sem_open() with O_CREAT |
O_EXCL on a semaphore that is already open in the process. The struct
sem_nameinfo would be freed while still in sem_list and later calls to
sem_open() or sem_close() could access freed memory.
PR: 206396
MFC after: 5 days
Notes
Notes:
svn path=/head/; revision=294565
Diffstat (limited to 'tools/regression')
-rw-r--r-- | tools/regression/posixsem2/semtest.c | 35 |
1 files changed, 35 insertions, 0 deletions
diff --git a/tools/regression/posixsem2/semtest.c b/tools/regression/posixsem2/semtest.c index b1255db83724..0879ff9fda78 100644 --- a/tools/regression/posixsem2/semtest.c +++ b/tools/regression/posixsem2/semtest.c @@ -7,6 +7,7 @@ #include <stdio.h> #include <stdlib.h> #include <err.h> +#include <errno.h> #include <fcntl.h> #include <unistd.h> @@ -14,6 +15,7 @@ int test_unnamed(void); int test_named(void); +int test_named2(void); int test_unnamed(void) @@ -94,9 +96,42 @@ test_named(void) } int +test_named2(void) +{ + sem_t *s, *s2, *s3; + + printf("testing named process-shared semaphore, O_EXCL cases\n"); + sem_unlink(SEM_NAME); + s = sem_open(SEM_NAME, O_CREAT | O_EXCL, 0777, 0); + if (s == SEM_FAILED) + err(1, "sem_open failed"); + s2 = sem_open(SEM_NAME, O_CREAT | O_EXCL, 0777, 0); + if (s2 != SEM_FAILED) + errx(2, "second sem_open call wrongly succeeded"); + if (errno != EEXIST) + err(3, "second sem_open call failed with wrong errno"); + + s3 = sem_open(SEM_NAME, 0); + if (s3 == SEM_FAILED) + err(4, "third sem_open call failed"); + if (s != s3) + errx(5, +"two sem_open calls for same semaphore do not return same address"); + if (sem_close(s3)) + err(6, "sem_close failed"); + + if (sem_close(s)) + err(7, "sem_close failed"); + + printf("OK.\n"); + return (0); +} + +int main(void) { test_unnamed(); test_named(); + test_named2(); return (0); } |