提交 da63f249 编写于 作者: G guzhihao4

Fix use after free in dlclose

Move free after unmap library
Issue: #I7VR0V
Test: libctest pass
Signed-off-by: Nguzhihao4 <guzhihao4@huawei.com>
Change-Id: I28c1d04d9894c32f4a0ad01fc2928532ea5df71b
上级 51ac0563
...@@ -3868,14 +3868,6 @@ static int dlclose_impl(struct dso *p, struct dso **dso_close_list, int *dso_clo ...@@ -3868,14 +3868,6 @@ static int dlclose_impl(struct dso *p, struct dso **dso_close_list, int *dso_clo
dso_close_list[*dso_close_list_size] = p; dso_close_list[*dso_close_list_size] = p;
*dso_close_list_size += 1; *dso_close_list_size += 1;
if (p->parents) {
free(p->parents);
}
free_reloc_can_search_dso(p);
if (p->tls.size == 0) {
free(p);
}
trace_marker_end(HITRACE_TAG_MUSL); trace_marker_end(HITRACE_TAG_MUSL);
return 0; return 0;
...@@ -3924,6 +3916,15 @@ static int do_dlclose(struct dso *p) ...@@ -3924,6 +3916,15 @@ static int do_dlclose(struct dso *p)
for (size_t i = 0; i < dso_close_list_size; i++) { for (size_t i = 0; i < dso_close_list_size; i++) {
unmap_library(dso_close_list[i]); unmap_library(dso_close_list[i]);
if (dso_close_list[i]->parents) {
free(dso_close_list[i]->parents);
}
free_reloc_can_search_dso(dso_close_list[i]);
if (dso_close_list[i]->tls.size == 0) {
free(dso_close_list[i]);
}
} }
free(dso_close_list); free(dso_close_list);
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册