diff options
Diffstat (limited to 'meta/recipes-core/uclibc/uclibc-git/libc-stdlib-canonicalize_file_name-memory-leak.patch')
-rw-r--r-- | meta/recipes-core/uclibc/uclibc-git/libc-stdlib-canonicalize_file_name-memory-leak.patch | 95 |
1 files changed, 95 insertions, 0 deletions
diff --git a/meta/recipes-core/uclibc/uclibc-git/libc-stdlib-canonicalize_file_name-memory-leak.patch b/meta/recipes-core/uclibc/uclibc-git/libc-stdlib-canonicalize_file_name-memory-leak.patch new file mode 100644 index 0000000000..83d21e2ec7 --- /dev/null +++ b/meta/recipes-core/uclibc/uclibc-git/libc-stdlib-canonicalize_file_name-memory-leak.patch | |||
@@ -0,0 +1,95 @@ | |||
1 | From patchwork Wed Oct 21 06:02:30 2015 | ||
2 | Content-Type: text/plain; charset="utf-8" | ||
3 | MIME-Version: 1.0 | ||
4 | Content-Transfer-Encoding: 7bit | ||
5 | Subject: libc/stdlib: canonicalize_file_name() memory leak | ||
6 | From: =?utf-8?q?Wojciech_Nizi=C5=84ski?= <niziak@spox.org> | ||
7 | X-Patchwork-Id: 533608 | ||
8 | Message-Id: <loom.20151021T080015-833@post.gmane.org> | ||
9 | To: uclibc@uclibc.org | ||
10 | Date: Wed, 21 Oct 2015 06:02:30 +0000 (UTC) | ||
11 | |||
12 | System based on Buildroot 2014.11 | ||
13 | Linux 3.10.88 | ||
14 | uclibc 0.9.33.2 (also with 1.0.2) | ||
15 | systemd 216 | ||
16 | gcc 4.8.3 (also with 4.9.2) | ||
17 | |||
18 | Bug: | ||
19 | After 2 days system is out of memory. PID 1 (systemd) is allocating. | ||
20 | over 120MB od RAM.. | ||
21 | Just after reboot PID 1 is taking only about 600kB. | ||
22 | |||
23 | How to reproduce: | ||
24 | With every systemd service reload or restart, heap of PID 1 grows. | ||
25 | Try with command: | ||
26 | watch -n1 \ | ||
27 | 'systemctl stop systemd-sysctl ; grep heap /proc/1/smaps -A15; free' | ||
28 | |||
29 | Source of bug: | ||
30 | |||
31 | Uclibc's canonicalize_file_name() is allocating temprary buffer of. | ||
32 | 4kB (PATH_MAX), and passing it to realpath() as second argument.. | ||
33 | Function canonicalize... is not checking if realpath() fails and. | ||
34 | memory is lost. | ||
35 | |||
36 | Backtrace: | ||
37 | #0 malloc (bytes=4096) at libc/stdlib/malloc-standard/malloc.c:844 | ||
38 | #1 canonicalize_file_name. | ||
39 | (name="/etc/systemd/system/systemd-sysctl.service.d") at. | ||
40 | libc/stdlib/canonicalize.c:30 | ||
41 | #2 path_strv_resolve (...) at src/shared/path-util.c:275 | ||
42 | |||
43 | Solution: | ||
44 | Do not use temporary buffer like in eglibc. | ||
45 | Function realpath() will be responsible for allocation. | ||
46 | |||
47 | From: Wojciech Nizinski <w.nizinski@grinn-global.com> | ||
48 | Date: Tue, 20 Oct 2015 14:08:09 +0200 | ||
49 | Subject: [PATCH]libc/stdlib: canonicalize_file_name() memory leak | ||
50 | |||
51 | Uclibc's canonicalize_file_name() is allocating temprary buffer of 4kB | ||
52 | (PATH_MAX), and passing it to realpath() as second argument. Function is | ||
53 | not checking if realpath() fails and memory is lost. | ||
54 | --- | ||
55 | Upstream-Status: Submitted | ||
56 | |||
57 | libc/stdlib/canonicalize.c | 21 +-------------------- | ||
58 | 1 file changed, 1 insertion(+), 20 deletions(-) | ||
59 | |||
60 | diff --git a/libc/stdlib/canonicalize.c b/libc/stdlib/canonicalize.c | ||
61 | index 06e710a..da09d58 100644 | ||
62 | --- a/libc/stdlib/canonicalize.c | ||
63 | +++ b/libc/stdlib/canonicalize.c | ||
64 | @@ -9,30 +9,11 @@ | ||
65 | */ | ||
66 | |||
67 | #include <stdlib.h> | ||
68 | -#include <limits.h> | ||
69 | |||
70 | #ifdef __USE_GNU | ||
71 | |||
72 | -#ifndef PATH_MAX | ||
73 | -# ifdef _POSIX_VERSION | ||
74 | -# define PATH_MAX _POSIX_PATH_MAX | ||
75 | -# else | ||
76 | -# ifdef MAXPATHLEN | ||
77 | -# define PATH_MAX MAXPATHLEN | ||
78 | -# else | ||
79 | -# define PATH_MAX 1024 | ||
80 | -# endif | ||
81 | -# endif | ||
82 | -#endif | ||
83 | - | ||
84 | char * canonicalize_file_name (const char *name) | ||
85 | { | ||
86 | - char *buf = (char *) malloc(PATH_MAX); | ||
87 | - | ||
88 | - if(unlikely(buf == NULL)) | ||
89 | - return NULL; | ||
90 | - | ||
91 | - *buf='\0'; | ||
92 | - return realpath (name, buf); | ||
93 | + return realpath (name, NULL); | ||
94 | } | ||
95 | #endif | ||