[Bug 295991] lib/libc posix_spawnp(): PATH-search child runs on an undersized rfork_thread stack and underflows into the caller's heap (heavily-linked processes; PHP proc_open)

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=295991

--- Comment #12 from commit-hook@FreeBSD.org ---
A commit in branch main references this bug:

URL:
https://cgit.FreeBSD.org/src/commit/?id=1e370f038778e16c4b31f8992dda339d429e5cb8

commit 1e370f038778e16c4b31f8992dda339d429e5cb8
Author:     Konstantin Belousov <kib@FreeBSD.org>
AuthorDate: 2026-06-27 15:11:37 +0000
Commit:     Konstantin Belousov <kib@FreeBSD.org>
CommitDate: 2026-06-29 20:33:12 +0000

    rtld: stop using unbound alloca()

    For DoneList allocations, its size depends on the number of loaded DSOs.
    Small images could be served by alloca(), but large donelists need to
    go into heap.

    For map_object(), alloca size is the number of segments in the object.

    In both cases, over-grown situations would cause a stack overflow.

    PR:     295991
    Noted and reviewed by:  kevans
    Tested by:      Marek Zarychta <zarychtam@plan-b.pwste.edu.pl>
    Sponsored by:   The FreeBSD Foundation
    MFC after:      1 week
    Differential revision:  https://reviews.freebsd.org/D57908

 libexec/rtld-elf/map_object.c |  4 ++-
 libexec/rtld-elf/rtld.c       | 82 ++++++++++++++++++++++++++++++-------------
 libexec/rtld-elf/rtld.h       |  2 ++
 3 files changed, 63 insertions(+), 25 deletions(-)

-- 
You are receiving this mail because:
You are the assignee for the bug.