From: Stas Sergeev <stsp2@yandex.ru>
To: libc-alpha@sourceware.org
Cc: Stas Sergeev <stsp2@yandex.ru>
Subject: [PATCH 01/11] elf: strdup() l_name if no realname [BZ #30100]
Date: Fri, 17 Mar 2023 11:32:00 +0500 [thread overview]
Message-ID: <20230317063210.4118076-2-stsp2@yandex.ru> (raw)
In-Reply-To: <20230317063210.4118076-1-stsp2@yandex.ru>
_dl_close_worker() has this code:
/* This name always is allocated. */
free (imap->l_name);
But in that particular case, while indeed being allocated, l_name
doesn't point to the start of an allocation:
new = (struct link_map *) calloc (sizeof (*new) + audit_space
+ sizeof (struct link_map *)
+ sizeof (*newname) + libname_len, 1);
...
new->l_symbolic_searchlist.r_list = (struct link_map **) ((char *) (new + 1)
+ audit_space);
new->l_libname = newname
= (struct libname_list *) (new->l_symbolic_searchlist.r_list + 1);
newname->name = (char *) memcpy (newname + 1, libname, libname_len);
...
new->l_name = (char *) newname->name + libname_len - 1;
It therefore cannot be freed separately.
Use strdup("") as a simple fix.
Signed-off-by: Stas Sergeev <stsp2@yandex.ru>
---
elf/dl-object.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/elf/dl-object.c b/elf/dl-object.c
index f1f2ec956c..ab926cd4bf 100644
--- a/elf/dl-object.c
+++ b/elf/dl-object.c
@@ -122,7 +122,10 @@ _dl_new_object (char *realname, const char *libname, int type,
#endif
new->l_name = realname;
else
- new->l_name = (char *) newname->name + libname_len - 1;
+ /* When realname="", it is not allocated and points to the constant
+ string. Constness is dropped by an explicit cast. :(
+ So strdup() it here. */
+ new->l_name = __strdup ("");
new->l_type = type;
/* If we set the bit now since we know it is never used we avoid
--
2.37.2
next prev parent reply other threads:[~2023-03-17 6:32 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-03-17 6:31 [PATCH v8 0/11] implement dlmem() function Stas Sergeev
2023-03-17 6:32 ` Stas Sergeev [this message]
2023-03-17 6:32 ` [PATCH 02/11] elf: switch _dl_map_segment() to anonymous mapping Stas Sergeev
2023-03-17 6:32 ` [PATCH 03/11] elf: dont pass fd to _dl_process_pt_xx Stas Sergeev
2023-03-17 6:32 ` [PATCH 04/11] elf: split _dl_map_object_from_fd() into reusable parts Stas Sergeev
2023-03-17 6:32 ` [PATCH 05/11] elf: split open_verify() " Stas Sergeev
2023-03-17 6:32 ` [PATCH 06/11] elf: load elf hdr fully in open_verify() Stas Sergeev
2023-03-17 6:32 ` [PATCH 07/11] elf: convert pread64 to callback in do_open_verify() Stas Sergeev
2023-03-17 6:32 ` [PATCH 08/11] elf: convert _dl_map_segments's mmap() to a callback Stas Sergeev
2023-03-17 6:32 ` [PATCH 09/11] elf: call _dl_map_segment() via premap callback Stas Sergeev
2023-03-17 6:32 ` [PATCH 10/11] elf: convert _dl_map_object to a callback Stas Sergeev
2023-03-17 6:32 ` [PATCH 11/11] dlfcn,elf: implement dlmem() [BZ #11767] Stas Sergeev
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230317063210.4118076-2-stsp2@yandex.ru \
--to=stsp2@yandex.ru \
--cc=libc-alpha@sourceware.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).