[Bug localedata/14594] New: Testing a mangled pointer results in initializer not being called

[Bug localedata/14594] New: Testing a mangled pointer results in initializer not being called

[law at redhat dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=14594

             Bug #: 14594
           Summary: Testing a mangled pointer results in initializer not
                    being called
           Product: glibc
           Version: 2.17
            Status: NEW
          Severity: normal
          Priority: P2
         Component: localedata
        AssignedTo: unassigned@sourceware.org
        ReportedBy: law@redhat.com
                CC: libc-locales@sources.redhat.com
    Classification: Unclassified


If a gconv module's init function has an address that is the same as the
pointer guard value, then the gconv module's init function will not be called.

The problem is find_module tests the *mangled* pointer against NULL and if that
test is false, then the initializer is called.

Obviously with the mangling function being a simple xor, if the function's
address is the same as the pointer guard, the mangled value will be zero and
the initializer doesn't get called.

Inspection shows similar problems gconv_db.c.  There's also an instance in
btowc.c, but in that case the test is just controlling an optimization and as
far as I can tell doesn't result in incorrect operation.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug localedata/14594] Testing a mangled pointer results in initializer not being called

[neleai at seznam dot cz]

https://sourceware.org/bugzilla/show_bug.cgi?id=14594

Ondrej Bilka <neleai at seznam dot cz> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |neleai at seznam dot cz

--- Comment #1 from Ondrej Bilka <neleai at seznam dot cz> ---
If function is xor then we could set last bit of guard to 1. As function
pointers are aligned a result cannot be zero.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug localedata/14594] Testing a mangled pointer results in initializer not being called

[carlos at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=14594

Carlos O'Donell <carlos at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |carlos at redhat dot com

--- Comment #2 from Carlos O'Donell <carlos at redhat dot com> ---
Fedora has a fix for this already I think, which is just unconditionally
demangle and *then* check for null.

There is almost not performance benefit to checking the mangled value for null,
demangling if it is, and then calling the function.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug localedata/14594] Testing a mangled pointer results in initializer not being called

[carlos at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=14594

--- Comment #3 from Carlos O'Donell <carlos at redhat dot com> ---
Created attachment 7263
  --> https://sourceware.org/bugzilla/attachment.cgi?id=7263&action=edit
Consistently demangle

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug localedata/14594] Testing a mangled pointer results in initializer not being called

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=14594

Florian Weimer <fweimer at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |fweimer at redhat dot com
              Flags|                            |security-

--- Comment #4 from Florian Weimer <fweimer at redhat dot com> ---
(In reply to Carlos O'Donell from comment #3)
> Created attachment 7263 [details]
> Consistently demangle

Does this really work? Are these pointers never initialized to NULL?

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug locale/14594] Testing a mangled pointer results in initializer not being called

[jsm28 at gcc dot gnu.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=14594

Joseph Myers <jsm28 at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
          Component|localedata                  |locale

-- 
You are receiving this mail because:
You are on the CC list for the bug.