public inbox for glibc-bugs@sourceware.org
help / color / mirror / Atom feed
* [Bug libc/13579] New: do_lookup_x may access dangling memory
@ 2012-01-10  7:41 ppluzhnikov at google dot com
  2012-01-10  7:46 ` [Bug libc/13579] " ppluzhnikov at google dot com
                   ` (31 more replies)
  0 siblings, 32 replies; 33+ messages in thread
From: ppluzhnikov at google dot com @ 2012-01-10  7:41 UTC (permalink / raw)
  To: glibc-bugs

http://sourceware.org/bugzilla/show_bug.cgi?id=13579

             Bug #: 13579
           Summary: do_lookup_x may access dangling memory
           Product: glibc
           Version: 2.15
            Status: NEW
          Severity: normal
          Priority: P2
         Component: libc
        AssignedTo: drepper.fsp@gmail.com
        ReportedBy: ppluzhnikov@google.com
    Classification: Unclassified


This shows up as a crash in gnucash with glibc-2.15 on Precise Pangolin.
https://bugs.launchpad.net/ubuntu/+source/eglibc/+bug/893605

Confirmed present in current glibc git trunk.

Test:

/// --- cut --- foo.c ---
int foo () { return bar (); }

/// --- cut --- bar.c ---
int bar () { return 42; }

/// --- cut --- t.c ---
#include <stdio.h>
#include <dlfcn.h>

int main ()
{
  void *h = dlopen ("./foo.so", RTLD_LAZY|RTLD_GLOBAL);
  void *p = dlsym (h, "bar");

  printf ("h = %p, p = %p\n", h, p);

  dlclose (h);

  h = dlopen ("./foo.so", RTLD_LAZY|RTLD_GLOBAL);
  p = dlsym (h, "bar");
  printf ("h = %p, p = %p\n", h, p);

  return 0;
}


gcc -fPIC -shared -o bar.so bar.c &&
gcc -fPIC -shared -o foo.so foo.c ./bar.so &&
gcc t.c ./foo.so ./bar.so -ldl

valgrind ./a.out        # no errors with glibc-2.11

==16605== Copyright (C) 2002-2011, and GNU GPL'd, by Julian Seward et al.
==16605== Using Valgrind-3.8.0.SVN and LibVEX; rerun with -h for copyright info
==16605== Command: ./a.out
==16605== 
h = 0x4023b78, p = 0x503759c
==16605== Invalid read of size 8
==16605==    at 0x40093F6: do_lookup_x (/tmp/glibc-git/elf/dl-lookup.c:98)
==16605==    by 0x4009E4A: _dl_lookup_symbol_x
(/tmp/glibc-git/elf/dl-lookup.c:739)
==16605==    by 0x5551305: do_sym (/tmp/glibc-git/elf/dl-sym.c:178)
==16605==    by 0x523A043: dlsym_doit (/tmp/glibc-git/dlfcn/dlsym.c:51)
==16605==    by 0x400E685: _dl_catch_error (/tmp/glibc-git/elf/dl-error.c:178)
==16605==    by 0x523A4DB: _dlerror_run (/tmp/glibc-git/dlfcn/dlerror.c:164)
==16605==    by 0x523A099: dlsym (/tmp/glibc-git/dlfcn/dlsym.c:71)
==16605==    by 0x400806: main (in /tmp/bug/a.out)
==16605==  Address 0x57e6098 is 40 bytes inside a block of size 72 free'd
==16605==    at 0x4C2C0EB: free
(/valgrind-test/coregrind/m_replacemalloc/vg_replace_malloc.c:426)
==16605==    by 0x4011D21: _dl_scope_free (/tmp/glibc-git/elf/dl-scope.c:32)
==16605==    by 0x4013446: _dl_close_worker (/tmp/glibc-git/elf/dl-close.c:130)
==16605==    by 0x401407B: _dl_close (/tmp/glibc-git/elf/dl-close.c:779)
==16605==    by 0x400E685: _dl_catch_error (/tmp/glibc-git/elf/dl-error.c:178)
==16605==    by 0x523A4DB: _dlerror_run (/tmp/glibc-git/dlfcn/dlerror.c:164)
==16605==    by 0x523A00E: dlclose (/tmp/glibc-git/dlfcn/dlclose.c:48)
==16605==    by 0x4007DF: main (in /tmp/bug/a.out)
==16605== 
h = 0x4023b78, p = 0x503759c
==16605== 
==16605== HEAP SUMMARY:
==16605==     in use at exit: 0 bytes in 0 blocks
==16605==   total heap usage: 2 allocs, 2 frees, 200 bytes allocated
==16605== 
==16605== All heap blocks were freed -- no leaks are possible
==16605== 
==16605== For counts of detected and suppressed errors, rerun with: -v
==16605== ERROR SUMMARY: 2 errors from 1 contexts (suppressed: 2 from 2)



The bug may have been introduced here:

commit 4bff6e0175ed195871f4e01cc4c4c33274b8f6e3
Author: Andreas Schwab <schwab@redhat.com>
Date:   Fri Feb 25 20:49:48 2011 -0500

    Fix memory leak in dlopen with RTLD_NOLOAD.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.


^ permalink raw reply	[flat|nested] 33+ messages in thread
end of thread, other threads:[~2014-06-13 15:00 UTC | newest]

Thread overview: 33+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2012-01-10  7:41 [Bug libc/13579] New: do_lookup_x may access dangling memory ppluzhnikov at google dot com
2012-01-10  7:46 ` [Bug libc/13579] " ppluzhnikov at google dot com
2012-02-20  7:13 ` polacek at redhat dot com
2012-02-21  2:31 ` [Bug ld.so|libdl/13579] " jsm28 at gcc dot gnu.org
2012-03-28 14:18 ` [Bug dynamic-link/13579] " ppluzhnikov at google dot com
2012-03-28 14:34 ` carlos_odonell at mentor dot com
2012-03-28 16:53 ` vapier at gentoo dot org
2012-04-05 18:08 ` aj at suse dot de
2012-04-05 18:08 ` aj at suse dot de
2012-04-05 20:10 ` law at redhat dot com
2012-04-06  3:18 ` carlos_odonell at mentor dot com
2012-04-06  7:00 ` aj at suse dot de
2012-04-06  7:04 ` aj at suse dot de
2012-04-06  8:50 ` carlos_odonell at mentor dot com
2012-04-06 11:27 ` aj at suse dot de
2012-04-21 20:41 ` carlos_odonell at mentor dot com
2012-04-21 20:42 ` carlos_odonell at mentor dot com
2012-04-22 13:27 ` carlos_odonell at mentor dot com
2012-04-22 19:27 ` carlos_odonell at mentor dot com
2012-05-01 21:59 ` matthew at linuxfromscratch dot org
2012-05-02 10:55 ` aj at suse dot de
2012-05-09 10:36 ` allan at archlinux dot org
2012-06-21  9:44 ` markus at trippelsdorf dot de
2012-06-21 13:32 ` carlos_odonell at mentor dot com
2012-06-21 13:59 ` aj at suse dot de
2012-06-22 20:56 ` carlos_odonell at mentor dot com
2013-02-12  1:36 ` gauryogesh.nsit at gmail dot com
2013-02-21 11:46 ` bharath.vegito at gmail dot com
2014-01-30 18:07 ` cvs-commit at gcc dot gnu.org
2014-02-16 19:20 ` jackie.rosen at hushmail dot com
2014-05-28 19:46 ` schwab at sourceware dot org
2014-05-28 19:47 ` schwab at sourceware dot org
2014-06-13 15:00 ` fweimer at redhat dot com

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).