Re: [PATCH] elf: sanitize objname in _dl_signal_error

[Adhemerval Zanella Netto <adhemerval.zanella@linaro.org>]

On 31/03/24 23:45, Jiangfeng Xiao wrote:
> "dlopen_doit" may execute
> "_dl_signal_error (0, NULL, NULL, ...)",
> which cause a segmentation fault.
> 
> The call stack is as follows:
> 
> Program received signal SIGSEGV, Segmentation fault.
> fatal_error (errcode=errcode@entry=0, objname=0x0, occasion=0x0,
>     errstring=errstring@entry=0xf7c90518 "invalid mode parameter")
> (gdb) bt
> @0  fatal_error (errcode=errcode@entry=0, objname=0x0, occasion=0x0,
>     errstring=errstring@entry=0xf7c90518 "invalid mode parameter")
> @1  0xf7de5260 in __GI__dl_signal_error (errcode=0, objname=0x0, occation=0x0,
>     errstring=0xf7c90518 "invalid mode parameter")
> @2  0xf7d0e204 in dlopen_doit (a=a@entry=0xfffefa94)
> 
> When objname is NULL, referencing *objname will accesses
> a null pointer. As a result, a segmentation fault occurs.
> 
> _dl_signal_error used to set objname to "" if it is null,
> it should continue to do so (this has been removed in commit 2449ae7b2d)
> 
> Fixes: 2449ae7b2da24 ("ld.so: Introduce struct dl_exception")

How did you trigger this issue, either from user provided ABI (dlfcn.h)
or some some internal usage (if any)? If this is a user-visible issue
it will require a bug report and a reproducer.

> 
> Suggested-by: Andreas Schwab <schwab@linux-m68k.org>
> Link: https://public-inbox.org/libc-alpha/1711806052-117857-1-git-send-email-xiaojiangfeng@huawei.com/
> Signed-off-by: Jiangfeng Xiao <xiaojiangfeng@huawei.com>
> ---
>  elf/dl-catch.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/elf/dl-catch.c b/elf/dl-catch.c
> index 2109516..92f0654 100644
> --- a/elf/dl-catch.c
> +++ b/elf/dl-catch.c
> @@ -117,6 +117,9 @@ _dl_signal_error (int errcode, const char *objname, const char *occasion,
>    if (! errstring)
>      errstring = N_("DYNAMIC LINKER BUG!!!");
>  
> +  if (! objname)
> +    objname = "";
> +
>    if (lcatch != NULL)
>      {
>        _dl_exception_create (lcatch->exception, objname, errstring);