From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: by sourceware.org (Postfix, from userid 1778) id 5C5083858430; Sat, 9 Jul 2022 08:46:16 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 5C5083858430 Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit From: Aurelien Jarno To: glibc-cvs@sourceware.org Subject: [glibc/release/2.33/master] elf: Earlier missing dynamic segment check in _dl_map_object_from_fd X-Act-Checkin: glibc X-Git-Author: Florian Weimer X-Git-Refname: refs/heads/release/2.33/master X-Git-Oldrev: d44e1a0740066416d3c331a3022ead5a7c4155ad X-Git-Newrev: 1916c5f0626a0127882aa3c60a91f47bafde8bbd Message-Id: <20220709084616.5C5083858430@sourceware.org> Date: Sat, 9 Jul 2022 08:46:16 +0000 (GMT) X-BeenThere: glibc-cvs@sourceware.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Glibc-cvs mailing list List-Unsubscribe: , List-Archive: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 09 Jul 2022 08:46:16 -0000 https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=1916c5f0626a0127882aa3c60a91f47bafde8bbd commit 1916c5f0626a0127882aa3c60a91f47bafde8bbd Author: Florian Weimer Date: Fri Nov 5 17:01:24 2021 +0100 elf: Earlier missing dynamic segment check in _dl_map_object_from_fd Separated debuginfo files have PT_DYNAMIC with p_filesz == 0. We need to check for that before the _dl_map_segments call because that could attempt to write to mappings that extend beyond the end of the file, resulting in SIGBUS. Reviewed-by: H.J. Lu (cherry picked from commit ea32ec354c65ddad11b82ca9d057010df13a9cea) Diff: --- elf/dl-load.c | 22 ++++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-) diff --git a/elf/dl-load.c b/elf/dl-load.c index 2f760503c5..639d78083c 100644 --- a/elf/dl-load.c +++ b/elf/dl-load.c @@ -1114,6 +1114,7 @@ _dl_map_object_from_fd (const char *name, const char *origname, int fd, struct loadcmd loadcmds[l->l_phnum]; size_t nloadcmds = 0; bool has_holes = false; + bool empty_dynamic = false; /* The struct is initialized to zero so this is not necessary: l->l_ld = 0; @@ -1126,7 +1127,9 @@ _dl_map_object_from_fd (const char *name, const char *origname, int fd, segments are mapped in. We record the addresses it says verbatim, and later correct for the run-time load address. */ case PT_DYNAMIC: - if (ph->p_filesz) + if (ph->p_filesz == 0) + empty_dynamic = true; /* Usually separate debuginfo. */ + else { /* Debuginfo only files from "objcopy --only-keep-debug" contain a PT_DYNAMIC segment with p_filesz == 0. Skip @@ -1248,6 +1251,13 @@ _dl_map_object_from_fd (const char *name, const char *origname, int fd, goto lose; } + /* This check recognizes most separate debuginfo files. */ + if (__glibc_unlikely ((l->l_ld == 0 && type == ET_DYN) || empty_dynamic)) + { + errstring = N_("object file has no dynamic section"); + goto lose; + } + /* Length of the sections to be loaded. */ maplength = loadcmds[nloadcmds - 1].allocend - loadcmds[0].mapstart; @@ -1265,15 +1275,7 @@ _dl_map_object_from_fd (const char *name, const char *origname, int fd, } } - if (l->l_ld == 0) - { - if (__glibc_unlikely (type == ET_DYN)) - { - errstring = N_("object file has no dynamic section"); - goto lose; - } - } - else + if (l->l_ld != 0) l->l_ld = (ElfW(Dyn) *) ((ElfW(Addr)) l->l_ld + l->l_addr); elf_get_dynamic_info (l, NULL);