fix out-of-bounds reads in __dns_parse

[musl] / src / exit / atexit.c

diff --git a/src/exit/atexit.c b/src/exit/atexit.c
index 49c060e..854e9fd 100644 (file)
--- a/src/exit/atexit.c
+++ b/src/exit/atexit.c
@@ -1,7 +1,13 @@
-#include <stddef.h>
 #include <stdlib.h>
-#include <limits.h>
+#include <stdint.h>
 #include "libc.h"
+#include "lock.h"
+#include "fork_impl.h"
+
+#define malloc __libc_malloc
+#define calloc __libc_calloc
+#define realloc undef
+#define free undef
 
 /* Ensure that at least 32 atexit handlers can be registered without malloc */
 #define COUNT 32
@@ -9,49 +15,65 @@
 static struct fl
 {
        struct fl *next;
-       void (*f[COUNT])(void);
+       void (*f[COUNT])(void *);
+       void *a[COUNT];
 } builtin, *head;
 
-static int run_atexit_functions(void)
+static int slot;
+static volatile int lock[1];
+volatile int *const __atexit_lockptr = lock;
+
+void __funcs_on_exit()
 {
-       int i;
-       for (; head; head=head->next) {
-               for (i=COUNT-1; i>=0 && !head->f[i]; i--);
-               for (; i>=0; i--) head->f[i]();
+       void (*func)(void *), *arg;
+       LOCK(lock);
+       for (; head; head=head->next, slot=COUNT) while(slot-->0) {
+               func = head->f[slot];
+               arg = head->a[slot];
+               UNLOCK(lock);
+               func(arg);
+               LOCK(lock);
        }
-       return 0;
 }
 
-int (*const __funcs_on_exit)(void) = run_atexit_functions;
-
-int atexit(void (*func)(void))
+void __cxa_finalize(void *dso)
 {
-       static int lock;
-       int i;
-
-       /* Hook for atexit extensions */
-       if (libc.atexit) return libc.atexit(func);
+}
 
-       LOCK(&lock);
+int __cxa_atexit(void (*func)(void *), void *arg, void *dso)
+{
+       LOCK(lock);
 
        /* Defer initialization of head so it can be in BSS */
        if (!head) head = &builtin;
 
        /* If the current function list is full, add a new one */
-       if (head->f[COUNT-1]) {
+       if (slot==COUNT) {
                struct fl *new_fl = calloc(sizeof(struct fl), 1);
                if (!new_fl) {
-                       UNLOCK(&lock);
+                       UNLOCK(lock);
                        return -1;
                }
                new_fl->next = head;
                head = new_fl;
+               slot = 0;
        }
 
        /* Append function to the list. */
-       for (i=0; i<COUNT && head->f[i]; i++);
-       head->f[i] = func;
+       head->f[slot] = func;
+       head->a[slot] = arg;
+       slot++;
 
-       UNLOCK(&lock);
+       UNLOCK(lock);
        return 0;
 }
+
+static void call(void *p)
+{
+       ((void (*)(void))(uintptr_t)p)();
+}
+
+int atexit(void (*func)(void))
+{
+       return __cxa_atexit(call, (void *)(uintptr_t)func, 0);
+}