> From: "Todd C. Miller" <todd.mil...@sudo.ws> > Date: Fri, 22 May 2020 07:23:55 -0600 > > On Fri, 22 May 2020 14:57:11 +0200, Marc Espie wrote: > > > From a security standpoint, is there a "cheap" way to make setlocale abort() > > instead of trying to do a double free on when running in a race condition ? > > We could use _THREAD_PRIVATE_MUTEX as we do in other parts of libc.
That might eliminate two threads racing eachoither in setlocale(), but it wouldn't stop threads that actually access the locale from use-after-free type bugs. Unless you use the lock there as well. But that could have a major performance impact.
