commit f586e1328681b400078c995a0bb6ad301ef73549

Author: Florian Weimer <fweimer@redhat.com>

Date:   Tue Oct 6 13:12:36 2015 +0200

    Harden tls_dtor_list with pointer mangling [BZ #19018]

diff --git a/stdlib/cxa_thread_atexit_impl.c b/stdlib/cxa_thread_atexit_impl.c

index 2d5d56a..5717f09 100644

--- a/stdlib/cxa_thread_atexit_impl.c

+++ b/stdlib/cxa_thread_atexit_impl.c

@@ -98,6 +98,10 @@ static __thread struct link_map *lm_cache;

 int

 __cxa_thread_atexit_impl (dtor_func func, void *obj, void *dso_symbol)

 {

+#ifdef PTR_MANGLE

+  PTR_MANGLE (func);

+#endif

+

   /* Prepend.  */

   struct dtor_list *new = calloc (1, sizeof (struct dtor_list));

   new->func = func;

@@ -142,9 +146,13 @@ __call_tls_dtors (void)

   while (tls_dtor_list)

     {

       struct dtor_list *cur = tls_dtor_list;

+      dtor_func func = cur->func;

+#ifdef PTR_DEMANGLE

+      PTR_DEMANGLE (func);

+#endif

       tls_dtor_list = tls_dtor_list->next;

-      cur->func (cur->obj);

+      func (cur->obj);

       /* Ensure that the MAP dereference happens before

 	 l_tls_dtor_count decrement.  That way, we protect this access from a