00db10
commit 6a1cf708dd5681b517744d6d4fac02e4e4a0aa2e
00db10
Author: Aurelien Jarno <aurelien@aurel32.net>
00db10
Date:   Wed Mar 11 21:03:50 2015 -0400
00db10
00db10
    Fix ldconfig segmentation fault with corrupted cache (Bug 18093).
00db10
00db10
--- glibc-2.17-c758a686/elf/cache.c
00db10
+++ glibc-2.17-c758a686/elf/cache.c
00db10
@@ -688,7 +688,9 @@
00db10
   if (aux_cache == MAP_FAILED
00db10
       || aux_cache_size < sizeof (struct aux_cache_file)
00db10
       || memcmp (aux_cache->magic, AUX_CACHEMAGIC, sizeof AUX_CACHEMAGIC - 1)
00db10
-      || aux_cache->nlibs >= aux_cache_size)
00db10
+      || aux_cache_size != (sizeof(struct aux_cache_file) +
00db10
+                            aux_cache->nlibs * sizeof(struct aux_cache_file_entry) +
00db10
+                            aux_cache->len_strings))
00db10
     {
00db10
       close (fd);
00db10
       init_aux_cache ();