riot-ci/RIOT
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Merge pull request #1025 from BytesGalore/add_out_of_bounds_check

Browse Source 
sys:posix:pthread added check to avoid array out of bound access
This commit is contained in:
BytesGalore 2014-04-25 18:00:07 +02:00
commit 9d4d98c9ea
1 changed files with 42 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

45
sys/posix/pthread/pthread.c
View File

@ -79,6 +79,7 @@ static char pthread_reaper_stack[PTHREAD_REAPER_STACKSIZE];
static void pthread_start_routine(void)
{
pthread_t self = pthread_self();
pthread_thread_t *pt = pthread_sched_threads[self-1];
void *retval = pt->start_routine(pt->arg);
pthread_exit(retval);
@ -164,7 +165,15 @@ int pthread_create(pthread_t *newthread, const pthread_attr_t *attr, void *(*sta
void pthread_exit(void *retval)
{
pthread_thread_t *self = pthread_sched_threads[pthread_self()-1];
pthread_t self_id = pthread_self();
if (self_id == 0) {
DEBUG("ERROR called pthread_self() returned 0 in \"%s\"!\n", __func__);
sched_task_exit();
return;
}
pthread_thread_t *self = pthread_sched_threads[self_id-1];
while (self->cleanup_top) {
__pthread_cleanup_datum_t *ct = self->cleanup_top;
@ -196,6 +205,11 @@ void pthread_exit(void *retval)
int pthread_join(pthread_t th, void **thread_return)
{
if (th < 1 || th > MAXTHREADS) {
DEBUG("passed pthread_t th (%d) exceeds bounds of pthread_sched_threads[] in \"%s\"!\n", th, __func__);
return -3;
}
pthread_thread_t *other = pthread_sched_threads[th-1];
if (!other) {
return -1;
@ -225,6 +239,11 @@ int pthread_join(pthread_t th, void **thread_return)
int pthread_detach(pthread_t th)
{
if (th < 1 || th > MAXTHREADS) {
DEBUG("passed pthread_t th (%d) exceeds bounds of pthread_sched_threads[] in \"%s\"!\n", th, __func__);
return -2;
}
pthread_thread_t *other = pthread_sched_threads[th-1];
if (!other) {
return -1;
@ -286,6 +305,12 @@ int pthread_setcanceltype(int type, int *oldtype)
void pthread_testcancel(void)
{
pthread_t self = pthread_self();
if (self == 0) {
DEBUG("ERROR called pthread_self() returned 0 in \"%s\"!\n", __func__);
return;
}
if (pthread_sched_threads[self-1]->should_cancel) {
pthread_exit(PTHREAD_CANCELED);
}
@ -293,14 +318,28 @@ void pthread_testcancel(void)
void __pthread_cleanup_push(__pthread_cleanup_datum_t *datum)
{
pthread_thread_t *self = pthread_sched_threads[pthread_self()-1];
pthread_t self_id = pthread_self();
if (self_id == 0) {
DEBUG("ERROR called pthread_self() returned 0 in \"%s\"!\n", __func__);
return;
}
pthread_thread_t *self = pthread_sched_threads[self_id-1];
datum->__next = self->cleanup_top;
self->cleanup_top = datum;
}
void __pthread_cleanup_pop(__pthread_cleanup_datum_t *datum, int execute)
{
pthread_thread_t *self = pthread_sched_threads[pthread_self()-1];
pthread_t self_id = pthread_self();
if (self_id == 0) {
DEBUG("ERROR called pthread_self() returned 0 in \"%s\"!\n", __func__);
return;
}
pthread_thread_t *self = pthread_sched_threads[self_id-1];
self->cleanup_top = datum->__next;
if (execute != 0) {