public inbox for glibc-bugs@sourceware.org
help / color / mirror / Atom feed
* [Bug dynamic-link/17411] New: calloc in dl-reloc.c computes size incorrectly
@ 2014-09-18 18:17 kg6fnk at gmail dot com
  2014-09-22 18:28 ` [Bug dynamic-link/17411] " carlos at redhat dot com
                   ` (3 more replies)
  0 siblings, 4 replies; 5+ messages in thread
From: kg6fnk at gmail dot com @ 2014-09-18 18:17 UTC (permalink / raw)
  To: glibc-bugs

https://sourceware.org/bugzilla/show_bug.cgi?id=17411

            Bug ID: 17411
           Summary: calloc in dl-reloc.c computes size incorrectly
           Product: glibc
           Version: unspecified
            Status: NEW
          Severity: normal
          Priority: P2
         Component: dynamic-link
          Assignee: unassigned at sourceware dot org
          Reporter: kg6fnk at gmail dot com

This bug was discovered by Matt LeGendre who works at LLNL. He pointed out the
problem and corrected my patch to the problem. It seems to exist in quite a
range of glibc versions. The problem was discovered in RHEL6's glibc and it
still exists in RHEL7 and upstream.

In elf/dl-reloc.c the AUDIT code does a calloc of a library's 
DT_PLTRELSZ*sizeof(struct reloc_result) (this is the one we're seeing making
~300MB of allocations).  It's treating the DT_PLTRELSZ as a count of PLTREL
entries, but DT_PLTRELSZ is the size in bytes of the PLTREL entries.  So it's
doing a much larger memory allocation than necessary.

I looked and the code is the same in RHEL6,7, and upstream glibc.
He suggested a patch like:

diff --git a/elf/dl-reloc.c b/elf/dl-reloc.c
index d2c6dac..0c85f08 100644
--- a/elf/dl-reloc.c
+++ b/elf/dl-reloc.c
@@ -280,7 +280,8 @@ _dl_relocate_object (struct link_map *l, struct
r_scope_elem *scope[],
          }

        l->l_reloc_result = calloc (sizeof (l->l_reloc_result[0]),
-                                   l->l_info[DT_PLTRELSZ]->d_un.d_val);
+                                   l->l_info[DT_PLTRELSZ]->d_un.d_val /
+                                   (l->l_info[DT_PLTREL]->d_un.d_val ==
DT_RELA ? sizeof(ElfW(Rela)) : sizeof(ElfW(Rel))));
        if (l->l_reloc_result == NULL)
          {
            errstring = N_("\

-- 
You are receiving this mail because:
You are on the CC list for the bug.


^ permalink raw reply	[flat|nested] 5+ messages in thread

end of thread, other threads:[~2015-02-06 15:34 UTC | newest]

Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2014-09-18 18:17 [Bug dynamic-link/17411] New: calloc in dl-reloc.c computes size incorrectly kg6fnk at gmail dot com
2014-09-22 18:28 ` [Bug dynamic-link/17411] " carlos at redhat dot com
2014-09-29 18:16 ` cvs-commit at gcc dot gnu.org
2014-09-29 18:17 ` carlos at redhat dot com
2015-02-06 15:34 ` cvs-commit at gcc dot gnu.org

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).