public inbox for libc-alpha@sourceware.org
 help / color / mirror / Atom feed
* [PATCH v2 1/2] elf: strdup() l_name if no realname [BZ #30100]
@ 2023-02-11 20:04 Stas Sergeev
  2023-02-11 20:04 ` [PATCH v2 2/2] dlfcn,elf: implement dlmem() function [BZ #11767] Stas Sergeev
  2023-02-12 13:44 ` [PATCH v2 1/2] elf: strdup() l_name if no realname [BZ #30100] Florian Weimer
  0 siblings, 2 replies; 3+ messages in thread
From: Stas Sergeev @ 2023-02-11 20:04 UTC (permalink / raw)
  To: libc-alpha; +Cc: Stas Sergeev

_dl_close_worker() has this code:
      /* This name always is allocated.  */
      free (imap->l_name);

But in that particular case, while indeed being allocated, l_name
doesn't point to the start of an allocation:
  new = (struct link_map *) calloc (sizeof (*new) + audit_space
                                    + sizeof (struct link_map *)
                                    + sizeof (*newname) + libname_len, 1);
  ...
  new->l_symbolic_searchlist.r_list = (struct link_map **) ((char *) (new + 1)
                                                            + audit_space);

  new->l_libname = newname
    = (struct libname_list *) (new->l_symbolic_searchlist.r_list + 1);
  newname->name = (char *) memcpy (newname + 1, libname, libname_len);
  ...
  new->l_name = (char *) newname->name + libname_len - 1;

It therefore cannot be freed separately.
Use strdup() as a simple fix.

Signed-off-by: Stas Sergeev <stsp2@yandex.ru>
---
 elf/dl-object.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/elf/dl-object.c b/elf/dl-object.c
index f1f2ec956c..c92daf37d1 100644
--- a/elf/dl-object.c
+++ b/elf/dl-object.c
@@ -122,7 +122,7 @@ _dl_new_object (char *realname, const char *libname, int type,
 #endif
     new->l_name = realname;
   else
-    new->l_name = (char *) newname->name + libname_len - 1;
+    new->l_name = __strdup ((char *) newname->name + libname_len - 1);
 
   new->l_type = type;
   /* If we set the bit now since we know it is never used we avoid
-- 
2.37.2


^ permalink raw reply	[flat|nested] 3+ messages in thread

end of thread, other threads:[~2023-02-12 15:01 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-02-11 20:04 [PATCH v2 1/2] elf: strdup() l_name if no realname [BZ #30100] Stas Sergeev
2023-02-11 20:04 ` [PATCH v2 2/2] dlfcn,elf: implement dlmem() function [BZ #11767] Stas Sergeev
2023-02-12 13:44 ` [PATCH v2 1/2] elf: strdup() l_name if no realname [BZ #30100] Florian Weimer

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).