fix out-of-bounds array access in pthread barriers on 64-bit

[musl] / src / internal / pthread_impl.h

diff --git a/src/internal/pthread_impl.h b/src/internal/pthread_impl.h
index 98d9b22..2348b5d 100644 (file)
--- a/src/internal/pthread_impl.h
+++ b/src/internal/pthread_impl.h
@@ -22,8 +22,12 @@
 
 struct pthread {
        struct pthread *self;
+       void *dtv, *unused1, *unused2;
+       uintptr_t sysinfo;
+       uintptr_t canary;
        pid_t tid, pid;
        int tsd_used, errno_val, *errno_ptr;
+       /* All cancellation-related fields must remain together, in order */
        volatile uintptr_t cp_sp, cp_ip;
        volatile int cancel, canceldisable, cancelasync;
        unsigned char *map_base;
@@ -79,7 +83,7 @@ struct __timer {
 #define _b_limit __u.__i[2]
 #define _b_count __u.__i[3]
 #define _b_waiters2 __u.__i[4]
-#define _b_inst __u.__p[4]
+#define _b_inst __u.__p[3]
 
 #include "pthread_arch.h"