diff options
Diffstat (limited to 'package/libs')
| -rw-r--r-- | package/libs/uclibc++/patches/030-memory_corruption_fix.patch | 114 |
1 files changed, 114 insertions, 0 deletions
diff --git a/package/libs/uclibc++/patches/030-memory_corruption_fix.patch b/package/libs/uclibc++/patches/030-memory_corruption_fix.patch new file mode 100644 index 0000000000..e34efdbb15 --- /dev/null +++ b/package/libs/uclibc++/patches/030-memory_corruption_fix.patch @@ -0,0 +1,114 @@ +From 1dc865b8bbb3911abc8ce53c7ae8a59dc90f6fc3 Mon Sep 17 00:00:00 2001 +From: Ivan Kold <pixus.ru@gmail.com> +Date: Thu, 3 Mar 2016 12:56:30 -0800 +Subject: [PATCH] Fix throw statement causing memory corruption + +The __cxxabiv1::__cxa_throw in the GCC's libsupc++ expects +sizeof(__cxa_refcounted_exception) bytes be allocated before +exception object. +uClibc++ allocates only sizeof(__cxa_exception) before an +exception object. +The __cxxabiv1::__cxa_throw writes in memory before allocated: +// gcc-5.2.0/libstdc++-v3/libsupc++/eh_throw.cc:69 +__cxa_refcounted_exception *header + = __get_refcounted_exception_header_from_obj (obj); +header->referenceCount = 1; + +Signed-off-by: Ivan Kold <pixus.ru@gmail.com> +--- + include/unwind-cxx.h | 34 +++++++++++++++++++++++++++++++++- + src/eh_alloc.cpp | 8 ++++---- + 2 files changed, 37 insertions(+), 5 deletions(-) + +--- a/include/unwind-cxx.h ++++ b/include/unwind-cxx.h +@@ -1,5 +1,5 @@ + // -*- C++ -*- Exception handling and frame unwind runtime interface routines. +-// Copyright (C) 2001 Free Software Foundation, Inc. ++// Copyright (C) 2001-2015 Free Software Foundation, Inc. + // + // This file is part of GCC. + // +@@ -13,6 +13,10 @@ + // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + // GNU General Public License for more details. + // ++// Under Section 7 of GPL version 3, you are granted additional ++// permissions described in the GCC Runtime Library Exception, version ++// 3.1, as published by the Free Software Foundation. ++// + // You should have received a copy of the GNU General Public License + // along with GCC; see the file COPYING. If not, write to + // the Free Software Foundation, 59 Temple Place - Suite 330, +@@ -40,6 +44,12 @@ + #include <cstddef> + #include "unwind.h" + ++// Original unwind-cxx.h also includes bits/atomic_word.h which is CPU-specific, ++// but always defines _Atomic_word as typedef int . ++// Only thing that differs is memory-barrier macroses. ++typedef int _Atomic_word; ++ ++ + #pragma GCC visibility push(default) + + namespace __cxxabiv1 +@@ -79,6 +89,13 @@ struct __cxa_exception + _Unwind_Exception unwindHeader; + }; + ++struct __cxa_refcounted_exception ++{ ++ // Manage this header. ++ _Atomic_word referenceCount; ++ // __cxa_exception must be last, and no padding can be after it. ++ __cxa_exception exc; ++}; + + // A dependent C++ exception object consists of a header, which is a wrapper + // around an unwind object header with additional C++ specific information, +@@ -210,6 +227,21 @@ __get_exception_header_from_ue (_Unwind_ + return reinterpret_cast<__cxa_exception *>(exc + 1) - 1; + } + ++// Acquire the C++ refcounted exception header from the C++ object. ++static inline __cxa_refcounted_exception * ++__get_refcounted_exception_header_from_obj (void *ptr) ++{ ++ return reinterpret_cast<__cxa_refcounted_exception *>(ptr) - 1; ++} ++ ++// Acquire the C++ refcounted exception header from the generic exception ++// header. ++static inline __cxa_refcounted_exception * ++__get_refcounted_exception_header_from_ue (_Unwind_Exception *exc) ++{ ++ return reinterpret_cast<__cxa_refcounted_exception *>(exc + 1) - 1; ++} ++ + } /* namespace __cxxabiv1 */ + + #pragma GCC visibility pop +--- a/src/eh_alloc.cpp ++++ b/src/eh_alloc.cpp +@@ -30,16 +30,16 @@ extern "C" void * __cxa_allocate_excepti + void *retval; + //The sizeof crap is required by Itanium ABI because we need to provide space for + //accounting information which is implementaion (gcc) specified +- retval = malloc (thrown_size + sizeof(__cxa_exception)); ++ retval = malloc (thrown_size + sizeof(__cxa_refcounted_exception)); + if (0 == retval){ + std::terminate(); + } +- memset (retval, 0, sizeof(__cxa_exception)); +- return (void *)((unsigned char *)retval + sizeof(__cxa_exception)); ++ memset (retval, 0, sizeof(__cxa_refcounted_exception)); ++ return (void *)((unsigned char *)retval + sizeof(__cxa_refcounted_exception)); + } + + extern "C" void __cxa_free_exception(void *vptr) throw(){ +- free( (char *)(vptr) - sizeof(__cxa_exception) ); ++ free( (char *)(vptr) - sizeof(__cxa_refcounted_exception) ); + } + + |