[Bug dynamic-link/15465] New: LD_DEBUG=symbols crashes when program name is not available

[Bug dynamic-link/15465] New: LD_DEBUG=symbols crashes when program name is not available

[siddhesh at redhat dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=15465

             Bug #: 15465
           Summary: LD_DEBUG=symbols crashes when program name is not
                    available
           Product: glibc
           Version: unspecified
            Status: NEW
          Severity: normal
          Priority: P2
         Component: dynamic-link
        AssignedTo: siddhesh@redhat.com
        ReportedBy: siddhesh@redhat.com
    Classification: Unclassified


Running a program with LD_DEBUG=symbols defined may crash if the program
tampers with argc and argv.

Steps to Reproduce:

foo.c:

#include <stdio.h>
#include <string.h>

int
main (int argc, char **argv)
{
  argv[0] = argv[1];
  argc--;

  foo ();
}

foo-lib.c:

void
foo (void)
{
  return; 
}

cc -o foo-lib.so -shared -fPIC foo-lib.c
cc -o foo foo.c ./foo-lib.so
LD_DEBUG=symbols ./foo

Actual Results:

Segfault

Expected Results:

No segfault.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug dynamic-link/15465] LD_DEBUG=symbols crashes when program name is not available

[siddhesh at redhat dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=15465

Siddhesh Poyarekar <siddhesh at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug dynamic-link/15465] LD_DEBUG=symbols crashes when program name is not available

[siddhesh at redhat dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=15465

Siddhesh Poyarekar <siddhesh at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #1 from Siddhesh Poyarekar <siddhesh at redhat dot com> ---
Fixed in master:

commit b937534868c8d7aec3b6d645bf5fd657bbfccd42
Author: Siddhesh Poyarekar <siddhesh@redhat.com>
Date:   Wed May 29 21:30:20 2013 +0530

    Avoid crashing in LD_DEBUG when program name is unavailable

    Resolves: #15465

    The program name may be unavailable if the user application tampers
    with argc and argv[].  Some parts of the dynamic linker caters for
    this while others don't, so this patch consolidates the check and
    fallback into a single macro and updates all users.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug dynamic-link/15465] LD_DEBUG=symbols crashes when program name is not available

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=15465

Florian Weimer <fweimer at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
              Flags|                            |security-

-- 
You are receiving this mail because:
You are on the CC list for the bug.