Fix race condition in decoding rt_sigtimedwait's timeout argument

As the value returned by sprint_timespec points to a static area and may
be overwritten by subsequent calls to sprint_timespec, it is not safe to
save this value on entering syscall and use it later on exiting.

* signal.c (SYS_FUNC(rt_sigtimedwait)): On entering syscall, copy the
value returned by sprint_timespec to a dynamically allocated memory,
and save the pointer using set_tcb_priv_data.  On exiting, restore it
using get_tcb_priv_data.

diff --git a/signal.c b/signal.c
index 8d36675ad355890ac876f9682894209f7deb182b..cb200bfd2eeb25987ba49047e1b8814d86bec707 100644 (file)
--- a/signal.c
+++ b/signal.c
@@ -662,23 +662,26 @@ SYS_FUNC(rt_sigtimedwait)
        if (entering(tcp)) {
                print_sigset_addr_len(tcp, tcp->u_arg[0], tcp->u_arg[3]);
                tprints(", ");
-               if (!tcp->u_arg[1]) {
+               if (!(tcp->u_arg[1] && verbose(tcp))) {
                        /*
                         * This is the only "return" parameter,
-                        * if it's NULL, decode all parameters on entry.
+                        * if we are not going to fetch it on exit,
+                        * decode all parameters on entry.
                         */
-                       tprints("NULL, ");
+                       printaddr(tcp->u_arg[1]);
+                       tprints(", ");
                        print_timespec(tcp, tcp->u_arg[2]);
                        tprintf(", %lu", tcp->u_arg[3]);
-                       tcp->auxstr = NULL;
                } else {
-                       tcp->auxstr = sprint_timespec(tcp, tcp->u_arg[2]);
+                       char *sts = xstrdup(sprint_timespec(tcp, tcp->u_arg[2]));
+                       set_tcb_priv_data(tcp, sts, free);
                }
        } else {
-               if (tcp->auxstr) {
+               if (tcp->u_arg[1] && verbose(tcp)) {
                        printsiginfo_at(tcp, tcp->u_arg[1]);
-                       tprintf(", %s, %lu", tcp->auxstr, tcp->u_arg[3]);
-                       tcp->auxstr = NULL;
+                       tprints(", ");
+                       tprints(get_tcb_priv_data(tcp));
+                       tprintf(", %lu", tcp->u_arg[3]);
                }
 
                if (!syserror(tcp) && tcp->u_rval) {