From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <glibc-bugs-return-4835-listarch-glibc-bugs=sources.redhat.com@sourceware.org>
Received: (qmail 8568 invoked by alias); 22 May 2006 14:57:00 -0000
Received: (qmail 8434 invoked by uid 48); 22 May 2006 14:56:32 -0000
Date: Mon, 22 May 2006 14:57:00 -0000
From: "satoru at 0xcc dot net" <sourceware-bugzilla@sourceware.org>
To: glibc-bugs@sources.redhat.com
Message-ID: <20060522145631.2683.satoru@0xcc.net>
Reply-To: sourceware-bugzilla@sourceware.org
Subject: [Bug libc/2683] New: dladdr() returns wrong symbol names in rare cases
X-Bugzilla-Reason: CC
Mailing-List: contact glibc-bugs-help@sourceware.org; run by ezmlm
Precedence: bulk
List-Subscribe: <mailto:glibc-bugs-subscribe@sourceware.org>
List-Post: <mailto:glibc-bugs@sourceware.org>
List-Help: <mailto:glibc-bugs-help@sourceware.org>, <http://sourceware.org/lists.html#faqs>
Sender: glibc-bugs-owner@sourceware.org
X-SW-Source: 2006-05/txt/msg00131.txt.bz2
List-Id: <glibc-bugs.sourceware.org>

I think undefined symbols should be skipped while finding symbols from dynamic
symbol tables in _dl_addr() in elf/dl-addr.c.  Otherwise, it returns wrong
symbol names in rare cases.

Here is the code for reproducing the problem.  I tested it on Debian GNU/Linux
sarge on a x86_32 machine (glibc 2.3.2) but looked like the latest glibc in CVS
had the same problem.

% cat main.c
#include <stdio.h>
#define __USE_GNU 1
#include <dlfcn.h>
extern void foo();
static void dummy_func() {}
int main() {
    Dl_info info;
    void *p = &foo;
    dladdr(dummy_func, &info);
    if (info.dli_sname) {
        printf("%s\n", info.dli_sname);
    }
    return 0;
}

% cat foo.c
void foo() {
    volatile int a = 0;
    // Make this function big.
    ++a; ++a; ++a; ++a; ++a; ++a; ++a; ++a; ++a; ++a; ++a; ++a; ++a; ++a;
    ++a; ++a; ++a; ++a; ++a; ++a; ++a; ++a; ++a; ++a; ++a; ++a; ++a; ++a;
    ++a; ++a; ++a; ++a; ++a; ++a; ++a; ++a; ++a; ++a; ++a; ++a; ++a; ++a;
    ++a; ++a; ++a; ++a; ++a; ++a; ++a; ++a; ++a; ++a; ++a; ++a; ++a; ++a;
    ++a; ++a; ++a; ++a; ++a; ++a; ++a; ++a; ++a; ++a; ++a; ++a; ++a; ++a;
}

% gcc -shared -o foo.so foo.c
% gcc -rdynamic main.c ./foo.so -ldl
% ./a.out
foo

Here, "foo" shouldn't be printed.

% readelf --symbols a.out | egrep 'foo|dummy_func'
    13: 080484d8   505 FUNC    GLOBAL DEFAULT  UND foo
    83: 08048594     5 FUNC    LOCAL  DEFAULT   12 dummy_func
   104: 080484d8   505 FUNC    GLOBAL DEFAULT  UND foo

"foo" was picked since the following condition satisfied.

  0x080484d8 (foo) <= 0x08048594 (dummmy_func) < 0x80486d1 (0x080484d8 + 505)


I haven't tested but I guess the following patch would solve the problem.

% diff -u elf/dl-addr.c.orig elf/dl-addr.c
--- elf/dl-addr.c.orig  2006-05-22 23:16:21.000000000 +0900
+++ elf/dl-addr.c       2006-05-22 23:16:42.000000000 +0900
@@ -92,6 +92,7 @@
 #if defined USE_TLS
            && ELFW(ST_TYPE) (symtab->st_info) != STT_TLS
 #endif
+            && symtab->st_shndx != SHN_UNDEF
            && DL_ADDR_SYM_MATCH (match, symtab, matchsym, addr)
            && symtab->st_name < strtabsize)
          matchsym = (ElfW(Sym) *) symtab;

-- 
           Summary: dladdr() returns wrong symbol names in rare cases
           Product: glibc
           Version: unspecified
            Status: NEW
          Severity: normal
          Priority: P2
         Component: libc
        AssignedTo: drepper at redhat dot com
        ReportedBy: satoru at 0xcc dot net
                CC: glibc-bugs at sources dot redhat dot com


http://sourceware.org/bugzilla/show_bug.cgi?id=2683

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.